mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Advisory Database Sync
This commit is contained in:
advisory-database[bot]
@@ -1,14 +1,17 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-8hg6-g75q-4x9v",
|
||||
"modified": "2022-05-24T22:00:37Z",
|
||||
"modified": "2023-03-29T21:30:22Z",
|
||||
"published": "2022-05-24T22:00:37Z",
|
||||
"aliases": [
|
||||
"CVE-2019-9008"
|
||||
],
|
||||
"details": "An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime.",
|
||||
"severity": [
|
||||
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
@@ -33,7 +36,7 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
"CWE-732"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
|
||||
@@ -1,14 +1,17 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-hr98-frg6-wvvr",
|
||||
"modified": "2022-05-24T22:00:36Z",
|
||||
"modified": "2023-03-29T21:30:22Z",
|
||||
"published": "2022-05-24T22:00:36Z",
|
||||
"aliases": [
|
||||
"CVE-2019-5481"
|
||||
],
|
||||
"details": "Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.",
|
||||
"severity": [
|
||||
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
@@ -73,7 +76,7 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
"CWE-415"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": false,
|
||||
|
||||
@@ -1,14 +1,17 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-j5c8-5345-567f",
|
||||
"modified": "2022-05-24T16:56:22Z",
|
||||
"modified": "2023-03-29T21:30:22Z",
|
||||
"published": "2022-05-24T16:56:22Z",
|
||||
"aliases": [
|
||||
"CVE-2019-16239"
|
||||
],
|
||||
"details": "process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.",
|
||||
"severity": [
|
||||
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
@@ -65,7 +68,7 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
"CWE-120"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
|
||||
@@ -1,14 +1,17 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-x9f6-xw7x-fm76",
|
||||
"modified": "2022-05-24T16:56:22Z",
|
||||
"modified": "2023-03-29T21:30:22Z",
|
||||
"published": "2022-05-24T16:56:22Z",
|
||||
"aliases": [
|
||||
"CVE-2019-16378"
|
||||
],
|
||||
"details": "OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be relevant to the origin of an e-mail message.",
|
||||
"severity": [
|
||||
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
@@ -61,7 +64,7 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
"CWE-290"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-24q5-7fw8-5m7f",
|
||||
"modified": "2023-03-29T21:30:19Z",
|
||||
"published": "2023-03-29T21:30:19Z",
|
||||
"aliases": [
|
||||
"CVE-2022-43621"
|
||||
],
|
||||
"details": "This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from an incorrectly implemented comparison. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-16152.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43621"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10310"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1503/"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-697"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T19:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2523-mx65-hm92",
|
||||
"modified": "2023-03-29T21:30:16Z",
|
||||
"published": "2023-03-29T21:30:16Z",
|
||||
"aliases": [
|
||||
"CVE-2022-44369"
|
||||
],
|
||||
"details": "NASM 2.16 (development) is vulnerable to 476: Null Pointer Dereference via output/outaout.c.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44369"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.nasm.us/show_bug.cgi?id=3392819"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T20:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-276x-2hgv-3x2j",
|
||||
"modified": "2023-03-29T21:30:20Z",
|
||||
"published": "2023-03-29T21:30:20Z",
|
||||
"aliases": [
|
||||
"CVE-2022-37375"
|
||||
],
|
||||
"details": "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPC files. Crafted data in a JPC file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18069.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37375"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.tracker-software.com/product/pdf-xchange-editor/history"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1103/"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-125"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T19:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2797-h4gc-wv56",
|
||||
"modified": "2023-03-29T21:30:21Z",
|
||||
"published": "2023-03-29T21:30:21Z",
|
||||
"aliases": [
|
||||
"CVE-2022-28311"
|
||||
],
|
||||
"details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. Crafted data in a DXF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16341.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28311"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0005"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-601/"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-125"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T19:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-29cx-mrrh-g7pc",
|
||||
"modified": "2023-03-29T21:30:20Z",
|
||||
"published": "2023-03-29T21:30:20Z",
|
||||
"aliases": [
|
||||
"CVE-2022-36980"
|
||||
],
|
||||
"details": "This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the EnterpriseServer service. The issue results from the lack of proper locking when performing operations during authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15528.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36980"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-785/"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-367"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T19:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2cpq-6g4r-6726",
|
||||
"modified": "2023-03-29T21:30:19Z",
|
||||
"published": "2023-03-29T21:30:19Z",
|
||||
"aliases": [
|
||||
"CVE-2022-43617"
|
||||
],
|
||||
"details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PCX files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16372.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43617"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1475/"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-787"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T19:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2jp6-jv62-jw48",
|
||||
"modified": "2023-03-29T21:30:20Z",
|
||||
"published": "2023-03-29T21:30:20Z",
|
||||
"aliases": [
|
||||
"CVE-2022-37367"
|
||||
],
|
||||
"details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. Crafted data in an AcroForm can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17726.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37367"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.tracker-software.com/product/pdf-xchange-editor/history"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1095/"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-125"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T19:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2rc8-5vp2-97ch",
|
||||
"modified": "2023-03-29T21:30:20Z",
|
||||
"published": "2023-03-29T21:30:20Z",
|
||||
"aliases": [
|
||||
"CVE-2022-37356"
|
||||
],
|
||||
"details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17630.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37356"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.tracker-software.com/product/pdf-xchange-editor/history"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1084/"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-787"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T19:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2rjc-h554-j93w",
|
||||
"modified": "2023-03-29T21:30:21Z",
|
||||
"published": "2023-03-29T21:30:21Z",
|
||||
"aliases": [
|
||||
"CVE-2022-36977"
|
||||
],
|
||||
"details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Certificate Management Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15449.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36977"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-782/"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-502"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T19:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2v4g-w3qw-prh4",
|
||||
"modified": "2023-03-29T21:30:17Z",
|
||||
"published": "2023-03-29T21:30:17Z",
|
||||
"aliases": [
|
||||
"CVE-2022-47607"
|
||||
],
|
||||
"details": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Usersnap plugin <= 4.16 versions.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47607"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://patchstack.com/database/vulnerability/usersnap/wordpress-usersnap-plugin-4-16-cross-site-scripting-xss?_s_id=cve"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T19:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2x7m-w9xq-pcvr",
|
||||
"modified": "2023-03-29T21:30:21Z",
|
||||
"published": "2023-03-29T21:30:21Z",
|
||||
"aliases": [
|
||||
"CVE-2022-28688"
|
||||
],
|
||||
"details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17201.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28688"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1127/"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-427"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T19:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-33j8-9xqj-q27p",
|
||||
"modified": "2023-03-29T21:30:21Z",
|
||||
"published": "2023-03-29T21:30:21Z",
|
||||
"aliases": [
|
||||
"CVE-2022-36972"
|
||||
],
|
||||
"details": "This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15328.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36972"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-777/"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-89"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T19:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-33jv-5wxr-v6v3",
|
||||
"modified": "2023-03-29T21:30:20Z",
|
||||
"published": "2023-03-29T21:30:20Z",
|
||||
"aliases": [
|
||||
"CVE-2022-37364"
|
||||
],
|
||||
"details": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17634.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37364"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.tracker-software.com/product/pdf-xchange-editor/history"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1092/"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-787"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T19:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3452-rvwh-rv7h",
|
||||
"modified": "2023-03-29T21:30:16Z",
|
||||
"published": "2023-03-29T21:30:16Z",
|
||||
"aliases": [
|
||||
"CVE-2023-1656"
|
||||
],
|
||||
"details": "Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server (RCS): from 1.5.20.9 through 1.5.20.13.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1656"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://backstage.forgerock.com/downloads/browse/idm/all/productId:idm-connectors/subProductId:ldap/minorVersion:1.5/version:1.5.20.14"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://backstage.forgerock.com/knowledge/kb/article/a14149722"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T20:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -1,14 +1,17 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-345m-hwph-xh83",
|
||||
"modified": "2023-03-24T21:30:52Z",
|
||||
"modified": "2023-03-29T21:30:22Z",
|
||||
"published": "2023-03-24T21:30:52Z",
|
||||
"aliases": [
|
||||
"CVE-2023-21047"
|
||||
],
|
||||
"details": "In ConvertToHalMetadata of aidl_utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-256166866References: N/A",
|
||||
"severity": [
|
||||
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
@@ -25,9 +28,9 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
"CWE-119"
|
||||
],
|
||||
"severity": null,
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-24T20:15:00Z"
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-345r-5qfx-4jpr",
|
||||
"modified": "2023-03-29T21:30:15Z",
|
||||
"published": "2023-03-29T21:30:15Z",
|
||||
"aliases": [
|
||||
"CVE-2023-28509"
|
||||
],
|
||||
"details": "Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 use weak encryption for packet-level security and passwords transferred on the wire.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28509"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.rapid7.com/blog/post/2023/03/29/multiple-vulnerabilities-in-rocket-software-unirpc-server-fixed/"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2023-03-29T21:15:00Z"
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user