Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2023-10-27 00:31:33 +00:00
parent f20cbbb9e8
commit fe08d13360
31 changed files with 667 additions and 44 deletions
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-433q-36rv-j5jj",
-  "modified": "2023-07-06T19:24:11Z",
+  "modified": "2023-10-27T00:30:18Z",
  "published": "2023-07-06T19:24:11Z",
  "aliases": [
    "CVE-2023-0053"
  ],
  "details": "SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for device management. Any sensitive information communicated through these protocols, such as credentials, is sent in cleartext. An attacker could obtain sensitive information such as user credentials to gain access to the system.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fr44-f297-ppg9",
-  "modified": "2023-07-06T19:24:07Z",
+  "modified": "2023-10-27T00:30:18Z",
  "published": "2023-07-06T19:24:07Z",
  "aliases": [
    "CVE-2023-0052"
  ],
  "details": "SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without credentials. As Telnet and file transfer protocol (FTP) are the only protocols available for device management, an unauthorized user could access the system and modify the device configuration, which could result in the unauthorized user executing unrestricted malicious commands.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2228-5m6x-4rqm",
+  "modified": "2023-10-27T00:30:18Z",
+  "published": "2023-10-27T00:30:18Z",
+  "aliases": [
+    "CVE-2018-16739"
+  ],
+  "details": "An issue was discovered on certain ABUS TVIP devices. Due to a path traversal in /opt/cgi/admin/filewrite, an attacker can write to files, and thus execute code arbitrarily with root privileges.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16739"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sec.maride.cc/posts/abus/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2g3g-vvgw-mw65",
-  "modified": "2023-10-25T18:32:24Z",
+  "modified": "2023-10-27T00:30:18Z",
  "published": "2023-10-25T18:32:24Z",
  "aliases": [
    "CVE-2023-46525"
  ],
  "details": "TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function loginRegister.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3j7c-23m3-57jj",
+  "modified": "2023-10-27T00:30:18Z",
+  "published": "2023-10-27T00:30:18Z",
+  "aliases": [
+    "CVE-2018-17559"
+  ],
+  "details": "Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS TVIP cameras.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17559"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sec.maride.cc/posts/abus/#cve-2018-17559"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4mh7-v2h4-6vf9",
+  "modified": "2023-10-27T00:30:18Z",
+  "published": "2023-10-27T00:30:18Z",
+  "aliases": [
+    "CVE-2023-43352"
+  ],
+  "details": "An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43352"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/sromanhu/CMSmadesimple-SSTI--Content"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/sromanhu/CVE-2023-43352-CMSmadesimple-SSTI--Content"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5p68-m49r-89rj",
+  "modified": "2023-10-27T00:30:18Z",
+  "published": "2023-10-27T00:30:18Z",
+  "aliases": [
+    "CVE-2023-43737"
+  ],
+  "details": "Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'fnm' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43737"
+    },
+    {
+      "type": "WEB",
+      "url": "https://fluidattacks.com/advisories/ono"
+    },
+    {
+      "type": "WEB",
+      "url": "https://https://projectworlds.in/"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5v38-92h7-3886",
-  "modified": "2023-10-25T18:32:24Z",
+  "modified": "2023-10-27T00:30:18Z",
  "published": "2023-10-25T18:32:24Z",
  "aliases": [
    "CVE-2023-46527"
  ],
  "details": "TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function bindRequestHandle.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-76g7-7jq2-pjg7",
-  "modified": "2023-10-25T18:32:24Z",
+  "modified": "2023-10-27T00:30:18Z",
  "published": "2023-10-25T18:32:24Z",
  "aliases": [
    "CVE-2023-46522"
  ],
  "details": "TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function deviceInfoRegister.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7j46-2fmc-fw7w",
+  "modified": "2023-10-27T00:30:18Z",
+  "published": "2023-10-27T00:30:18Z",
+  "aliases": [
+    "CVE-2023-46374"
+  ],
+  "details": "ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46374"
+    },
+    {
+      "type": "WEB",
+      "url": "https://narrow-payment-2cd.notion.site/ZenTao-4-1-3-is-vulnerable-to-Cross-Site-Scripting-xss-CVE-2023-46374-ebdc61e7a88443b481b649764ba66dee"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7jxg-pm47-89ph",
+  "modified": "2023-10-27T00:30:18Z",
+  "published": "2023-10-27T00:30:18Z",
+  "aliases": [
+    "CVE-2018-17878"
+  ],
+  "details": "Buffer Overflow vulnerability in certain ABUS TVIP cameras allows attackers to gain control of the program via crafted string sent to sprintf() function.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17878"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sec.maride.cc/posts/abus/#cve-2018-17878"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7qw4-phr3-pm8x",
+  "modified": "2023-10-27T00:30:18Z",
+  "published": "2023-10-27T00:30:18Z",
+  "aliases": [
+    "CVE-2023-5805"
+  ],
+  "details": "A vulnerability was found in SourceCodester Simple Real Estate Portal System 1.0. It has been classified as critical. Affected is an unknown function of the file view_estate.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-243618 is the identifier assigned to this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5805"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/lxxcute/Bug/blob/main/Real%20Estate%20Portal%20System%20view_estate.php%20has%20Sqlinjection.pdf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.243618"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.243618"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8992-9q7r-8chp",
-  "modified": "2023-10-25T18:32:24Z",
+  "modified": "2023-10-27T00:30:18Z",
  "published": "2023-10-25T18:32:24Z",
  "aliases": [
    "CVE-2023-46521"
  ],
  "details": "TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function RegisterRegister.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-92g2-c2g8-rfxp",
-  "modified": "2023-10-25T18:32:24Z",
+  "modified": "2023-10-27T00:30:18Z",
  "published": "2023-10-25T18:32:24Z",
  "aliases": [
    "CVE-2023-46526"
  ],
  "details": "TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function resetCloudPwdRegister.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-cq8v-q3f4-9cwp",
-  "modified": "2023-10-25T18:32:24Z",
+  "modified": "2023-10-27T00:30:18Z",
  "published": "2023-10-25T18:32:24Z",
  "aliases": [
    "CVE-2023-46520"
  ],
  "details": "TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function uninstallPluginReqHandle.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-ffqm-rxh4-r75f",
+  "modified": "2023-10-27T00:30:18Z",
+  "published": "2023-10-27T00:30:18Z",
+  "aliases": [
+    "CVE-2023-27170"
+  ],
+  "details": "Xpand IT Write-back manager v2.3.1 allows attackers to perform a directory traversal via modification of the siteName parameter.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27170"
+    },
+    {
+      "type": "WEB",
+      "url": "https://balwurk.com/cve-2023-27170-improper-limitation-of-a-pathname-to-a-restricted-directory/"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fj49-xvp9-p96q",
+  "modified": "2023-10-27T00:30:18Z",
+  "published": "2023-10-27T00:30:18Z",
+  "aliases": [
+    "CVE-2018-17558"
+  ],
+  "details": "Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.18, TVIP11050 MG.1.6.03.05, TVIP20550 LM.1.6.18, TVIP10050 LM.1.6.18, TVIP11550 MG.1.6.03, TVIP21050 MG.1.6.03, and TVIP51550 MG.1.6.03 cameras allow remote attackers to execute code as root.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17558"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sec.maride.cc/posts/abus/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-gh52-2rq4-cqx2",
-  "modified": "2023-10-25T18:32:25Z",
+  "modified": "2023-10-27T00:30:18Z",
  "published": "2023-10-25T18:32:25Z",
  "aliases": [
    "CVE-2023-46535"
  ],
  "details": "TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function getResetVeriRegister.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hxv9-4gxx-v284",
+  "modified": "2023-10-27T00:30:18Z",
+  "published": "2023-10-27T00:30:18Z",
+  "aliases": [
+    "CVE-2023-42406"
+  ],
+  "details": "SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive information and execute arbitrary code via the editrole.php component.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42406"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/flyyue2001/cve/blob/main/D-LINK%20-DAR-7000_sql_:sysmanage:editrole.php.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-jfmm-v8pp-89h8",
-  "modified": "2023-10-25T18:32:25Z",
+  "modified": "2023-10-27T00:30:18Z",
  "published": "2023-10-25T18:32:25Z",
  "aliases": [
    "CVE-2023-46539"
  ],
  "details": "TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function registerRequestHandle.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
    "severity": null,
    "github_reviewed": false,
--- a/Show More
+++ b/Show More