Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2023-04-24 15:31:41 +00:00
parent de97aa5655
commit e4d111beed
41 changed files with 919 additions and 46 deletions
@@ -24,6 +24,10 @@
    {
      "type": "WEB",
      "url": "https://gitee.com/isoftforce/dreamer_cms/issues/I5U408"
+    },
+    {
+      "type": "WEB",
+      "url": "https://packetstormsecurity.com/files/171585/Dreamer-CMS-4.0.0-SQL-Injection.html"
    }
  ],
  "database_specific": {
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2968-fmvc-r6gw",
-  "modified": "2023-04-14T03:30:28Z",
+  "modified": "2023-04-24T15:30:29Z",
  "published": "2023-04-14T03:30:28Z",
  "aliases": [
    "CVE-2023-1285"
  ],
  "details": "Signal Handler Race Condition vulnerability in Mitsubishi Electric India GC-ENET-COM whose first 2 digits of 11-digit serial number of unit are \"16\" allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition in Ethernet communication by sending a large number of specially crafted packets to any UDP port when GC-ENET-COM is configured as a Modbus TCP Server. The communication resumes only when the power of the main unit is turned off and on or when the GC-ENET-COM is hot-swapped from the main unit.\n",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -29,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-362",
+      "CWE-364"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2cvf-r7fr-6p6p",
+  "modified": "2023-04-24T15:30:34Z",
+  "published": "2023-04-24T15:30:34Z",
+  "aliases": [
+    "CVE-2023-30371"
+  ],
+  "details": "In Tenda AC15 V15.03.05.19, the function \"sub_ED14\" contains a stack-based buffer overflow vulnerability.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30371"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/2205794866/Tenda/blob/main/AC15/4.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3vvp-9ghf-fqvw",
-  "modified": "2023-04-11T21:31:01Z",
+  "modified": "2023-04-24T15:30:27Z",
  "published": "2023-04-11T21:31:01Z",
  "aliases": [
    "CVE-2023-26555"
  ],
  "details": "praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-44r5-q922-2rc3",
+  "modified": "2023-04-24T15:30:34Z",
+  "published": "2023-04-24T15:30:34Z",
+  "aliases": [
+    "CVE-2023-29848"
+  ],
+  "details": "Bang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php Add New Menu function.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29848"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mesinkasir/bangresto/issues/2"
+    },
+    {
+      "type": "WEB",
+      "url": "http://packetstormsecurity.com/files/171899/Bang-Resto-1.0-Cross-Site-Scripting.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-47mh-6hjv-3484",
+  "modified": "2023-04-24T15:30:34Z",
+  "published": "2023-04-24T15:30:34Z",
+  "aliases": [
+    "CVE-2023-30372"
+  ],
+  "details": "In Tenda AC15 V15.03.05.19, The function \"xkjs_ver32\" contains a stack-based buffer overflow vulnerability.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30372"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/2205794866/Tenda/blob/main/AC15/10.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-747c-jg37-7m9c",
+  "modified": "2023-04-24T15:30:33Z",
+  "published": "2023-04-24T15:30:33Z",
+  "aliases": [
+    "CVE-2022-48477"
+  ],
+  "details": "In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48477"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.jetbrains.com/privacy-security/issues-fixed/"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-918"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-767v-xrqh-x67m",
-  "modified": "2023-04-13T09:30:18Z",
+  "modified": "2023-04-24T15:30:29Z",
  "published": "2023-04-13T09:30:18Z",
  "aliases": [
    "CVE-2022-40532"
  ],
  "details": "Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-190"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-78m2-q358-37wh",
-  "modified": "2023-04-11T21:30:57Z",
+  "modified": "2023-04-24T15:30:27Z",
  "published": "2023-04-11T21:30:57Z",
  "aliases": [
    "CVE-2023-28808"
  ],
  "details": "Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-284"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7j3x-mrc3-42pg",
+  "modified": "2023-04-24T15:30:33Z",
+  "published": "2023-04-24T15:30:33Z",
+  "aliases": [
+    "CVE-2023-1731"
+  ],
+  "details": "In LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would allow an remote authenticated attacker with high privileges to execute arbitrary commands.\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1731"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-2023-02-lantime-firmware-v7-06-013.htm"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-83w8-56qx-9vq7",
-  "modified": "2023-04-14T21:30:23Z",
+  "modified": "2023-04-24T15:30:29Z",
  "published": "2023-04-14T21:30:23Z",
  "aliases": [
    "CVE-2023-29090"
  ],
  "details": "An issue was discovered in Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP Via header.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9hjw-9cqg-v7h7",
+  "modified": "2023-04-24T15:30:35Z",
+  "published": "2023-04-24T15:30:35Z",
+  "aliases": [
+    "CVE-2023-30375"
+  ],
+  "details": "In Tenda AC15 V15.03.05.19, the function \"getIfIp\" contains a stack-based buffer overflow vulnerability.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30375"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/2205794866/Tenda/blob/main/AC15/1.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9rj4-9hjf-7pcg",
+  "modified": "2023-04-24T15:30:33Z",
+  "published": "2023-04-24T15:30:33Z",
+  "aliases": [
+    "CVE-2023-29579"
+  ],
+  "details": "yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the component yasm/yasm+0x43b466 in vsprintf.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29579"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/yasm/yasm/issues/214"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/z1r00/fuzz_vuln/blob/main/yasm/stack-buffer-overflow/yasm/readmd.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9w4w-2cpw-g65c",
-  "modified": "2023-04-14T21:30:23Z",
+  "modified": "2023-04-24T15:30:29Z",
  "published": "2023-04-14T21:30:23Z",
  "aliases": [
    "CVE-2023-29089"
  ],
  "details": "An issue was discovered in Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding SIP multipart messages.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-cw85-fvjr-j5xv",
-  "modified": "2023-04-13T21:30:27Z",
+  "modified": "2023-04-24T15:30:28Z",
  "published": "2023-04-13T21:30:27Z",
  "aliases": [
    "CVE-2023-22951"
  ],
  "details": "An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token can be read from the configuration file. Using this token on the REST API provides an attacker with anonymous admin-level privileges on all REST API endpoints.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cxvw-qhc5-36vm",
+  "modified": "2023-04-24T15:30:35Z",
+  "published": "2023-04-24T15:30:35Z",
+  "aliases": [
+    "CVE-2023-30378"
+  ],
+  "details": "In Tenda AC15 V15.03.05.19, the function \"sub_8EE8\" contains a stack-based buffer overflow vulnerability.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30378"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/2205794866/Tenda/blob/main/AC15/5.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f9xv-q969-pqx4",
+  "modified": "2023-04-24T15:30:34Z",
+  "published": "2023-04-24T15:30:34Z",
+  "aliases": [
+    "CVE-2023-2251"
+  ],
+  "details": "Uncaught Exception in GitHub repository eemeli/yaml prior to 2.2.2.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2251"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/eemeli/yaml/commit/984f5781ffd807e58cad3b5c8da1f940dab75fba"
+    },
+    {
+      "type": "WEB",
+      "url": "https://huntr.dev/bounties/4b494e99-5a3e-40d9-8678-277f3060e96c"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-248"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fh2p-qw35-q7r4",
-  "modified": "2023-04-13T09:30:19Z",
+  "modified": "2023-04-24T15:30:27Z",
  "published": "2023-04-13T09:30:19Z",
  "aliases": [
    "CVE-2022-33291"
  ],
  "details": "Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -25,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-125"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fmcm-3vcv-q39p",
-  "modified": "2023-04-14T21:30:23Z",
+  "modified": "2023-04-24T15:30:29Z",
  "published": "2023-04-14T21:30:23Z",
  "aliases": [
    "CVE-2023-29091"
  ],
  "details": "An issue was discovered in Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP URI.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fpx6-4jxg-6422",
-  "modified": "2023-04-14T21:30:23Z",
+  "modified": "2023-04-24T15:30:29Z",
  "published": "2023-04-14T21:30:23Z",
  "aliases": [
    "CVE-2023-29087"
  ],
  "details": "An issue was discovered in Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123. Memory corruption can occur due to insufficient parameter validation while decoding an SIP Retry-After header.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H"
+    }
  ],
  "affected": [

--- a/Show More
+++ b/Show More