Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2023-05-04 18:32:08 +00:00
parent e0e8288139
commit c33ec4745b
26 changed files with 472 additions and 27 deletions
@@ -48,6 +48,10 @@
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2022/dsa-5100"
+    },
+    {
+      "type": "WEB",
+      "url": "http://packetstormsecurity.com/files/172148/Shannon-Baseband-fmtp-SDP-Attribute-Memory-Corruption.html"
    }
  ],
  "database_specific": {
@@ -40,6 +40,10 @@
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/166744/Asterisk-Project-Security-Advisory-AST-2022-001.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://packetstormsecurity.com/files/172139/Shannon-Baseband-chatroom-SDP-Attribute-Memory-Corruption.html"
    }
  ],
  "database_specific": {
@@ -28,6 +28,10 @@
    {
      "type": "WEB",
      "url": "https://www.mgm-sp.com/en/cve-2022-26497-bigbluebutton-greenlight-xss/"
+    },
+    {
+      "type": "WEB",
+      "url": "http://packetstormsecurity.com/files/172143/Shannon-Baseband-acfg-pcfg-SDP-Attribute-Memory-Corruption.html"
    }
  ],
  "database_specific": {
@@ -28,6 +28,10 @@
    {
      "type": "WEB",
      "url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/"
+    },
+    {
+      "type": "WEB",
+      "url": "http://packetstormsecurity.com/files/172137/Shannon-Baseband-accept-type-SDP-Attribute-Memory-Corruption.html"
    }
  ],
  "database_specific": {
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2h2j-55g7-g43c",
-  "modified": "2023-04-24T21:30:30Z",
+  "modified": "2023-05-04T18:30:51Z",
  "published": "2023-04-24T21:30:30Z",
  "aliases": [
    "CVE-2023-1624"
  ],
  "details": "The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2rx2-wvh6-wg6m",
-  "modified": "2023-04-24T21:30:30Z",
+  "modified": "2023-05-04T18:30:51Z",
  "published": "2023-04-24T21:30:30Z",
  "aliases": [
    "CVE-2023-2257"
  ],
  "details": "Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub \nBusiness space without being prompted to enter the password via an \nunimplemented \"Force Login\" security feature.\n\nThis vulnerability occurs only if \"Force Login\" feature is enabled on the Hub Business instance and that an attacker has access to a locked Workspace desktop application configured with a Hub Business space.\n",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-863"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-611"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-395r-3vpg-67gw",
-  "modified": "2023-04-24T21:30:30Z",
+  "modified": "2023-05-04T18:30:51Z",
  "published": "2023-04-24T21:30:30Z",
  "aliases": [
    "CVE-2023-29780"
  ],
  "details": "Third Reality Smart Blind 1.00.54 contains a denial-of-service vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -29,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-20"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-611"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7jv7-hr35-fwjr",
-  "modified": "2023-04-24T21:30:30Z",
+  "modified": "2023-05-04T18:30:51Z",
  "published": "2023-04-24T21:30:30Z",
  "aliases": [
    "CVE-2023-29469"
  ],
  "details": "An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\\0' value).",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -33,7 +36,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-415"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9gqr-rx5g-cgrq",
-  "modified": "2023-04-25T15:30:29Z",
+  "modified": "2023-05-04T18:30:52Z",
  "published": "2023-04-25T15:30:29Z",
  "aliases": [
    "CVE-2023-29779"
  ],
  "details": "Sengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a remote attacker to send malicious Zigbee messages to a vulnerable device and cause crashes. After receiving the malicious command, the device will keep reporting its status and finally drain its battery after receiving the 'Set_short_poll_interval' command.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -30,6 +30,10 @@
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2023/04/18/14"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.openwall.com/lists/oss-security/2023/05/03/4"
+    },
    {
      "type": "WEB",
      "url": "https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-m42j-4xh8-862v",
-  "modified": "2023-04-25T15:30:29Z",
+  "modified": "2023-05-04T18:30:52Z",
  "published": "2023-04-25T15:30:29Z",
  "aliases": [
    "CVE-2023-30417"
  ],
  "details": "A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title of a private message.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -25,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-pwx9-2gvj-242v",
-  "modified": "2023-04-25T15:30:27Z",
+  "modified": "2023-05-04T18:30:51Z",
  "published": "2023-04-25T15:30:27Z",
  "aliases": [
    "CVE-2022-42335"
  ],
  "details": "x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -37,7 +40,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-476"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-q945-mj3h-45f2",
-  "modified": "2023-04-25T00:30:41Z",
+  "modified": "2023-05-04T18:30:51Z",
  "published": "2023-04-25T00:30:41Z",
  "aliases": [
    "CVE-2023-2007"
  ],
  "details": "The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-367"
+      "CWE-367",
+      "CWE-667"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-xch2-6rcx-h2mv",
-  "modified": "2023-04-26T00:30:21Z",
+  "modified": "2023-05-04T18:30:52Z",
  "published": "2023-04-26T00:30:21Z",
  "aliases": [
    "CVE-2023-30111"
  ],
  "details": "Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-39xg-53hj-p9pw",
+  "modified": "2023-05-04T18:30:53Z",
+  "published": "2023-05-04T18:30:53Z",
+  "aliases": [
+    "CVE-2023-29994"
+  ],
+  "details": "In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29994"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/emqx/nanomq/issues/1042"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-43x4-4r99-6r59",
+  "modified": "2023-05-04T18:30:53Z",
+  "published": "2023-05-04T18:30:53Z",
+  "aliases": [
+    "CVE-2023-2521"
+  ],
+  "details": "A vulnerability was found in NEXTU NEXT-7004N 3.0.1. It has been classified as problematic. Affected is an unknown function of the file /boafrm/formFilter of the component POST Request Handler. The manipulation of the argument url with the input <svg onload=alert(1337)> leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-228012. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2521"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.228012"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.228012"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5mw6-x44r-m884",
+  "modified": "2023-05-04T18:30:53Z",
+  "published": "2023-05-04T18:30:53Z",
+  "aliases": [
+    "CVE-2023-2522"
+  ],
+  "details": "A vulnerability was found in Chengdu VEC40G 3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /send_order.cgi?parameter=access_detect of the component Network Detection. The manipulation of the argument COUNT with the input 3 | netstat -an leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228013 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2522"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/eckert-lcc/cve/blob/main/Flying%20fish%20star.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.228013"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.228013"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-78"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6537-rwx6-xqvm",
+  "modified": "2023-05-04T18:30:53Z",
+  "published": "2023-05-04T18:30:53Z",
+  "aliases": [
+    "CVE-2023-2519"
+  ],
+  "details": "A vulnerability has been found in Caton CTP Relay Server 1.2.9 and classified as critical. This vulnerability affects unknown code of the file /server/api/v1/login of the component API. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. VDB-228010 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2519"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.228010"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.228010"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
--- a/Show More
+++ b/Show More