Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2023-07-24 15:31:35 +00:00
parent c002d9a60d
commit 028dc05b92
68 changed files with 382 additions and 54 deletions
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-f5xq-h855-6hmf",
-  "modified": "2022-01-27T00:03:54Z",
+  "modified": "2023-07-24T15:30:18Z",
  "published": "2022-01-20T00:02:04Z",
  "aliases": [
    "CVE-2022-22155"
  ],
  "details": "An Uncontrolled Resource Consumption vulnerability in the handling of IPv6 neighbor state change events in Juniper Networks Junos OS allows an adjacent attacker to cause a memory leak in the Flexible PIC Concentrator (FPC) of an ACX5448 router. The continuous flapping of an IPv6 neighbor with specific timing will cause the FPC to run out of resources, leading to a Denial of Service (DoS) condition. Once the condition occurs, further packet processing will be impacted, creating a sustained Denial of Service (DoS) condition, requiring a manual PFE restart to restore service. The following error messages will be seen after the FPC resources have been exhausted: fpc0 DNX_NH::dnx_nh_tag_ipv4_hw_install(),3135: dnx_nh_tag_ipv4_hw_install: BCM L3 Egress create object failed for NH 602 (-14:No resources for operation), BCM NH Params: unit:0 Port:41, L3_INTF:0 Flags: 0x40 fpc0 DNX_NH::dnx_nh_tag_ipv4_hw_install(),3135: dnx_nh_tag_ipv4_hw_install: BCM L3 Egress create object failed for NH 602 (-14:No resources for operation), BCM NH Params: unit:0 Port:41, L3_INTF:0 Flags: 0x40 fpc0 DNX_NH::dnx_nh_tag_ipv4_hw_install(),3135: dnx_nh_tag_ipv4_hw_install: BCM L3 Egress create object failed for NH 602 (-14:No resources for operation), BCM NH Params: unit:0 Port:41, L3_INTF:0 Flags: 0x40 fpc0 DNX_NH::dnx_nh_tag_ipv4_hw_install(),3135: dnx_nh_tag_ipv4_hw_install: BCM L3 Egress create object failed for NH 602 (-14:No resources for operation), BCM NH Params: unit:0 Port:41, L3_INTF:0 Flags: 0x40 This issue only affects the ACX5448 router. No other products or platforms are affected by this vulnerability. This issue affects Juniper Networks Junos OS on ACX5448: 18.4 versions prior to 18.4R3-S10; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S8, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S3, 19.4R2-S2, 19.4R3; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R1-S1, 20.2R2.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -25,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-400"
+      "CWE-400",
+      "CWE-401"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-20"
+      "CWE-20",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mjgc-6w7g-2jm9",
-  "modified": "2022-01-16T00:01:05Z",
+  "modified": "2023-07-24T15:30:17Z",
  "published": "2022-01-11T00:00:55Z",
  "aliases": [
    "CVE-2022-22271"
  ],
  "details": "A missing input validation before memory copy in TIMA trustlet prior to SMR Jan-2022 Release 1 allows attackers to copy data from arbitrary memory.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -25,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-125",
      "CWE-20"
    ],
    "severity": "MODERATE",
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-q493-fq52-3qhm",
-  "modified": "2022-01-22T00:02:15Z",
+  "modified": "2023-07-24T15:30:18Z",
  "published": "2022-01-15T00:01:53Z",
  "aliases": [
    "CVE-2022-20698"
  ],
  "details": "A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper checks that may result in an invalid pointer read. An attacker could exploit this vulnerability by sending a crafted OOXML file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -25,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-125",
      "CWE-20"
    ],
    "severity": "HIGH",
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-qjg9-wm29-5rcr",
-  "modified": "2022-01-28T00:03:46Z",
+  "modified": "2023-07-24T15:30:18Z",
  "published": "2022-01-22T00:00:47Z",
  "aliases": [
    "CVE-2022-21933"
  ],
  "details": "ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) to modify memory, resulting in arbitrary code execution for controlling the system or disrupting service.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-20"
+      "CWE-20",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-457",
      "CWE-787",
      "CWE-908"
    ],
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-45m8-h637-23mm",
-  "modified": "2022-02-27T00:00:25Z",
+  "modified": "2023-07-24T15:30:19Z",
  "published": "2022-02-19T00:01:26Z",
  "aliases": [
    "CVE-2022-21800"
  ],
  "details": "MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed passwords.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -25,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-326",
      "CWE-327"
    ],
    "severity": "MODERATE",
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-97p6-2wmw-hgqw",
-  "modified": "2022-02-18T00:00:55Z",
+  "modified": "2023-07-24T15:30:19Z",
  "published": "2022-02-11T00:00:45Z",
  "aliases": [
    "CVE-2022-20680"
  ],
  "details": "A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to improper enforcement of Administrator privilege levels for low-value sensitive data. An attacker with read-only Administrator access to the web-based management interface could exploit this vulnerability by sending a malicious HTTP request to the page that contains the sensitive data. A successful exploit could allow the attacker to collect sensitive information about users of the system and orders that have been placed using the application.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -25,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-200",
      "CWE-269"
    ],
    "severity": "MODERATE",
@@ -36,7 +36,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-200"
+      "CWE-200",
+      "CWE-427"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-vqjc-h5m3-4q6j",
-  "modified": "2022-02-27T00:00:25Z",
+  "modified": "2023-07-24T15:30:19Z",
  "published": "2022-02-19T00:01:27Z",
  "aliases": [
    "CVE-2022-21196"
  ],
  "details": "MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. An attacker may gain access to these API routes and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,6 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-285",
+      "CWE-287",
      "CWE-863"
    ],
    "severity": "CRITICAL",
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-20"
+      "CWE-20",
+      "CWE-755"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-287",
      "CWE-522"
    ],
    "severity": "MODERATE",
@@ -32,6 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-285",
      "CWE-863"
    ],
    "severity": "MODERATE",
@@ -44,7 +44,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-400"
+      "CWE-400",
+      "CWE-404"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-203",
      "CWE-326"
    ],
    "severity": "MODERATE",
@@ -33,6 +33,7 @@
  "database_specific": {
    "cwe_ids": [
      "CWE-326",
+      "CWE-327",
      "CWE-359"
    ],
    "severity": "HIGH",
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-327",
+      "CWE-693"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-284"
+      "CWE-284",
+      "CWE-863"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-22"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-22",
+      "CWE-755"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
--- a/Show More
+++ b/Show More