Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2023-07-10 18:31:58 +00:00
parent 6bc11b132b
commit ba7f4f071b
164 changed files with 5308 additions and 52 deletions
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-434"
+      "CWE-434",
+      "CWE-78"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,7 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-601"
+      "CWE-601",
+      "CWE-74",
+      "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -21,6 +21,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36179"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00009.html"
+    },
    {
      "type": "WEB",
      "url": "https://yoroi.company/research/cve-advisory-full-disclosure-multiple-vulnerabilities/"
@@ -21,6 +21,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36180"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00009.html"
+    },
    {
      "type": "WEB",
      "url": "https://yoroi.company/research/cve-advisory-full-disclosure-multiple-vulnerabilities/"
@@ -40,6 +40,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-287",
      "CWE-798"
    ],
    "severity": "CRITICAL",
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-287"
+      "CWE-287",
+      "CWE-352"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-q7rw-9gg7-5wfw",
-  "modified": "2022-12-14T00:30:23Z",
+  "modified": "2023-07-10T18:30:41Z",
  "published": "2022-12-14T00:30:23Z",
  "aliases": [
    "CVE-2022-41653"
  ],
  "details": "Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials and control the system.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-259"
+      "CWE-259",
+      "CWE-798"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -32,6 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-20",
      "CWE-400"
    ],
    "severity": "MODERATE",
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-119"
+      "CWE-119",
+      "CWE-822"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -40,7 +40,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-400"
+      "CWE-400",
+      "CWE-770"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-1393",
+      "CWE-287"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -29,6 +29,14 @@
      "type": "WEB",
      "url": "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/"
+    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/dist/CPAN/changes"
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-770",
      "CWE-789"
    ],
    "severity": "HIGH",
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-pcw9-xw4x-jgj3",
-  "modified": "2023-06-23T21:30:33Z",
+  "modified": "2023-07-10T18:30:42Z",
  "published": "2023-06-23T21:30:33Z",
  "aliases": [
    "CVE-2023-34188"
  ],
  "details": "The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-w92h-gfcv-m7wv",
-  "modified": "2023-06-28T21:30:29Z",
+  "modified": "2023-07-10T18:30:42Z",
  "published": "2023-06-28T21:30:29Z",
  "aliases": [
    "CVE-2023-33570"
  ],
  "details": "Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-29xr-xpp4-5783",
+  "modified": "2023-07-10T18:30:49Z",
+  "published": "2023-07-10T18:30:49Z",
+  "aliases": [
+    "CVE-2023-3273"
+  ],
+  "details": "\nImproper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability of the device by changing settings of the device such as the IP\naddress based on missing access control.\n\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3273"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sick.com/psirt"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2fmj-pq77-gvj7",
+  "modified": "2023-07-10T18:30:47Z",
+  "published": "2023-07-10T18:30:47Z",
+  "aliases": [
+    "CVE-2023-1119"
+  ],
+  "details": "The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin through 2.4 use a third-party library that removes the escaping on some HTML characters, leading to a Cross-Site Scripting vulnerability.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1119"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/2e78735a-a7fc-41fe-8284-45bf451eff06"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2h4j-hwr9-94jw",
+  "modified": "2023-07-10T18:30:49Z",
+  "published": "2023-07-10T18:30:49Z",
+  "aliases": [
+    "CVE-2023-3270"
+  ],
+  "details": "Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the system.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3270"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.json"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0006.pdf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sick.com/psirt"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2hf7-q8gj-r58v",
+  "modified": "2023-07-10T18:30:50Z",
+  "published": "2023-07-10T18:30:50Z",
+  "aliases": [
+    "CVE-2023-37706"
+  ],
+  "details": "Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the entrys parameter in the fromAddressNat function.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37706"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6903"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2wjj-p9fg-qxjq",
+  "modified": "2023-07-10T18:30:50Z",
+  "published": "2023-07-10T18:30:50Z",
+  "aliases": [
+    "CVE-2023-37707"
+  ],
+  "details": "Tenda FH1203 V2.0.1.6 was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37707"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FirmRec/IoT-Vulns/tree/main/tenda/6904"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
--- a/Show More
+++ b/Show More