CVE sync 2026-11-12T01:30:16Z
This commit is contained in:
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-10-09T22:24:14.527Z",
|
||||
"datePublished": "2026-11-11T18:38:17.370Z",
|
||||
"dateUpdated": "2026-11-11T18:38:17.370Z"
|
||||
"dateUpdated": "2026-11-12T00:12:25.032Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -182,6 +182,21 @@
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"title": "CVE Program Container",
|
||||
"references": [
|
||||
{
|
||||
"url": "http://www.openwall.com/lists/oss-security/2026/11/11/27"
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||||
"shortName": "CVE",
|
||||
"dateUpdated": "2026-11-12T00:12:25.032Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "fortinet",
|
||||
"dateReserved": "2026-11-03T14:32:11.672Z",
|
||||
"datePublished": "2026-11-10T20:10:36.385Z",
|
||||
"dateUpdated": "2026-11-10T20:32:45.405Z"
|
||||
"dateUpdated": "2026-11-12T00:04:36.559Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -109,7 +109,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
|
||||
"shortName": "fortinet",
|
||||
"dateUpdated": "2026-11-10T20:10:36.385Z"
|
||||
"dateUpdated": "2026-11-12T00:04:36.559Z"
|
||||
},
|
||||
"problemTypes": [
|
||||
{
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-07T12:24:19.135Z",
|
||||
"datePublished": "2026-11-07T14:17:50.983Z",
|
||||
"dateUpdated": "2026-11-10T20:05:13.928Z"
|
||||
"dateUpdated": "2026-11-12T00:12:26.454Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -200,12 +200,15 @@
|
||||
"references": [
|
||||
{
|
||||
"url": "http://www.openwall.com/lists/oss-security/2026/11/10/15"
|
||||
},
|
||||
{
|
||||
"url": "http://www.openwall.com/lists/oss-security/2026/11/11/29"
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||||
"shortName": "CVE",
|
||||
"dateUpdated": "2026-11-10T20:05:13.928Z"
|
||||
"dateUpdated": "2026-11-12T00:12:26.454Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-11-07T12:24:19.492Z",
|
||||
"datePublished": "2026-11-07T14:17:51.711Z",
|
||||
"dateUpdated": "2026-11-11T03:59:43.169Z"
|
||||
"dateUpdated": "2026-11-12T00:12:27.908Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -180,6 +180,19 @@
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-11T03:59:43.169Z"
|
||||
}
|
||||
},
|
||||
{
|
||||
"title": "CVE Program Container",
|
||||
"references": [
|
||||
{
|
||||
"url": "http://www.openwall.com/lists/oss-security/2026/11/11/28"
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||||
"shortName": "CVE",
|
||||
"dateUpdated": "2026-11-12T00:12:27.908Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@@ -0,0 +1,136 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-125785",
|
||||
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Patchstack",
|
||||
"dateReserved": "2026-11-10T12:37:30.984Z",
|
||||
"datePublished": "2026-11-12T00:12:02.005Z",
|
||||
"dateUpdated": "2026-11-12T00:13:02.392Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
|
||||
"shortName": "Patchstack",
|
||||
"dateUpdated": "2026-11-12T00:13:02.392Z"
|
||||
},
|
||||
"title": "WordPress JetEngine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability",
|
||||
"datePublic": "2026-11-12T00:11:00.000Z",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.1.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.<p>This issue affects JetEngine: from n/a through 3.9.1.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Crocoblock",
|
||||
"product": "JetEngine",
|
||||
"packageName": "jet-engine",
|
||||
"collectionURL": "https://crocoblock.com",
|
||||
"defaultStatus": "unaffected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0",
|
||||
"versionType": "custom",
|
||||
"status": "affected",
|
||||
"lessThanOrEqual": "3.9.1",
|
||||
"changes": [
|
||||
{
|
||||
"at": "3.9.1.1",
|
||||
"status": "unaffected"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve",
|
||||
"tags": [
|
||||
"vdb-entry"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "nh4tvd | Patchstack Bug Bounty Program",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
|
||||
"baseScore": 6.5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "LOW"
|
||||
}
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-79",
|
||||
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-592",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Stored XSS"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Update the WordPress JetEngine plugin to the latest available version (at least 3.9.1.1).",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Update the WordPress JetEngine plugin to the latest available version (at least 3.9.1.1)."
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,139 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-125786",
|
||||
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Patchstack",
|
||||
"dateReserved": "2026-11-10T12:37:30.984Z",
|
||||
"datePublished": "2026-11-12T00:11:00.501Z",
|
||||
"dateUpdated": "2026-11-12T00:12:01.381Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
|
||||
"shortName": "Patchstack",
|
||||
"dateUpdated": "2026-11-12T00:12:01.381Z"
|
||||
},
|
||||
"title": "WordPress Quiz And Survey Master plugin <= 11.3.0 - Content Injection vulnerability",
|
||||
"datePublic": "2026-11-12T00:10:00.000Z",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Code Injection.This issue affects Quiz And Survey Master: from n/a through 11.3.0.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Code Injection.<p>This issue affects Quiz And Survey Master: from n/a through 11.3.0.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "ExpressTech",
|
||||
"product": "Quiz And Survey Master",
|
||||
"packageName": "quiz-master-next",
|
||||
"collectionURL": "https://wordpress.org/plugins",
|
||||
"defaultStatus": "unaffected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0",
|
||||
"versionType": "custom",
|
||||
"status": "affected",
|
||||
"lessThanOrEqual": "11.3.0",
|
||||
"changes": [
|
||||
{
|
||||
"at": "11.3.1",
|
||||
"status": "unaffected"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-3-0-content-injection-vulnerability?_s_id=cve",
|
||||
"tags": [
|
||||
"vdb-entry"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Benjamin Kincses (Dextheking1) | Patchstack Bug Bounty Program",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE"
|
||||
}
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-80",
|
||||
"description": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-242",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Code Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Update the WordPress Quiz And Survey Master plugin to the latest available version (at least 11.3.1).",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Update the WordPress Quiz And Survey Master plugin to the latest available version (at least 11.3.1)."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"tags": [
|
||||
"x_open-source"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,139 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-125787",
|
||||
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Patchstack",
|
||||
"dateReserved": "2026-11-10T12:37:30.984Z",
|
||||
"datePublished": "2026-11-12T00:09:32.263Z",
|
||||
"dateUpdated": "2026-11-12T00:10:32.490Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
|
||||
"shortName": "Patchstack",
|
||||
"dateUpdated": "2026-11-12T00:10:32.490Z"
|
||||
},
|
||||
"title": "WordPress Quiz And Survey Master plugin <= 11.3.0 - Broken Access Control vulnerability",
|
||||
"datePublic": "2026-11-12T00:09:00.000Z",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 11.3.0.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Quiz And Survey Master: from n/a through 11.3.0.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "ExpressTech",
|
||||
"product": "Quiz And Survey Master",
|
||||
"packageName": "quiz-master-next",
|
||||
"collectionURL": "https://wordpress.org/plugins",
|
||||
"defaultStatus": "unaffected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0",
|
||||
"versionType": "custom",
|
||||
"status": "affected",
|
||||
"lessThanOrEqual": "11.3.0",
|
||||
"changes": [
|
||||
{
|
||||
"at": "11.3.1",
|
||||
"status": "unaffected"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-3-0-broken-access-control-vulnerability?_s_id=cve",
|
||||
"tags": [
|
||||
"vdb-entry"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Daniel Walker | Patchstack Bug Bounty Program",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
|
||||
"baseScore": 5.4,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE"
|
||||
}
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-862",
|
||||
"description": "Missing Authorization",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-180",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Update the WordPress Quiz And Survey Master plugin to the latest available version (at least 11.3.1).",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Update the WordPress Quiz And Survey Master plugin to the latest available version (at least 11.3.1)."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"tags": [
|
||||
"x_open-source"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,95 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126673",
|
||||
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "CPANSec",
|
||||
"dateReserved": "2026-11-11T12:57:30.656Z",
|
||||
"datePublished": "2026-11-12T00:44:34.065Z",
|
||||
"dateUpdated": "2026-11-12T00:44:34.065Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"affected": [
|
||||
{
|
||||
"collectionURL": "https://cpan.org/modules",
|
||||
"defaultStatus": "unaffected",
|
||||
"modules": [
|
||||
"Data::Dump::Streamer"
|
||||
],
|
||||
"packageName": "Data-Dump-Streamer",
|
||||
"packageURL": "pkg:cpan/Data-Dump-Streamer",
|
||||
"programFiles": [
|
||||
"lib/Data/Dump/Streamer.pm"
|
||||
],
|
||||
"programRoutines": [
|
||||
{
|
||||
"name": "Data::Dump::Streamer::_dump_qr"
|
||||
}
|
||||
],
|
||||
"repo": "https://github.com/demerphq/Data-Dump-Streamer",
|
||||
"versions": [
|
||||
{
|
||||
"lessThan": "3.00",
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"versionType": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr.\n\nA Regexp's pattern is written into a qr literal without escaping \"$\" or \"@\", so \"@{[ ... ]}\" and \"${\\ ... }\" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.\n\nAn attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code."
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-94",
|
||||
"description": "CWE-94 Improper Control of Generation of Code",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
|
||||
"shortName": "CPANSec",
|
||||
"dateUpdated": "2026-11-12T00:44:34.065Z"
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"tags": [
|
||||
"release-notes"
|
||||
],
|
||||
"url": "https://metacpan.org/release/YVES/Data-Dump-Streamer-3.00/source/Changes"
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Upgrade to Data-Dump-Streamer 3.00 or later."
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"title": "Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr",
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "For deployments that cannot upgrade to 3.00, which requires Perl 5.18 and a C compiler, do not restore dumps that contain Regexps compiled from untrusted input."
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "cpansec-cna-tool 0.1"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,166 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126785",
|
||||
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulDB",
|
||||
"dateReserved": "2026-11-11T19:16:48.153Z",
|
||||
"datePublished": "2026-11-12T00:30:24.749Z",
|
||||
"dateUpdated": "2026-11-12T00:30:24.749Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
|
||||
"shortName": "VulDB",
|
||||
"dateUpdated": "2026-11-12T00:30:24.749Z"
|
||||
},
|
||||
"title": "rmalright TR-VISION HOME IOCTL WFanManager.sys sub_11504 default permission",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-276",
|
||||
"lang": "en",
|
||||
"description": "Incorrect Default Permissions"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"type": "CWE",
|
||||
"cweId": "CWE-266",
|
||||
"lang": "en",
|
||||
"description": "Incorrect Privilege Assignment"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "rmalright",
|
||||
"product": "TR-VISION HOME",
|
||||
"versions": [
|
||||
{
|
||||
"version": "2.0.5",
|
||||
"status": "affected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:rmalright:tr-vision_home:*:*:*:*:*:*:*:*"
|
||||
],
|
||||
"modules": [
|
||||
"IOCTL Handler"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect default permissions. The attack must be carried out locally. The vendor was contacted early about this disclosure but did not respond in any way."
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"cvssV4_0": {
|
||||
"version": "4.0",
|
||||
"baseScore": 9.3,
|
||||
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X",
|
||||
"baseSeverity": "CRITICAL"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"baseScore": 8.8,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:C",
|
||||
"baseSeverity": "HIGH"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_0": {
|
||||
"version": "3.0",
|
||||
"baseScore": 8.8,
|
||||
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:C",
|
||||
"baseSeverity": "HIGH"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV2_0": {
|
||||
"version": "2.0",
|
||||
"baseScore": 6.8,
|
||||
"vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:C"
|
||||
}
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"time": "2026-11-11T00:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "Advisory disclosed"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-11T01:00:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry created"
|
||||
},
|
||||
{
|
||||
"time": "2026-11-11T20:21:58.000Z",
|
||||
"lang": "en",
|
||||
"value": "VulDB entry last update"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Element2023H (VulDB User)",
|
||||
"type": "reporter"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "VulDB CNA Team",
|
||||
"type": "coordinator"
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/435969",
|
||||
"name": "VDB-435969 | rmalright TR-VISION HOME IOCTL WFanManager.sys sub_11504 default permission",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"technical-description"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/vuln/435969/cti",
|
||||
"name": "VDB-435969 | CTI Indicators (IOB, IOC, TTP, IOA)",
|
||||
"tags": [
|
||||
"signature",
|
||||
"permissions-required"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/cve/CVE-2026-126785",
|
||||
"name": "CVE-2026-126785 | CVE Analysis and Report",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/submit/1040412",
|
||||
"name": "Submit #1040412 | Thermalright TR-VISION HOME Software V2.0.5 Incorrect Default Permissions",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_generator": [
|
||||
"VulDB PVTS v202611"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
+8
-14
@@ -1,20 +1,14 @@
|
||||
{
|
||||
"fetchTime": "2026-11-11T23:24:17.911Z",
|
||||
"numberOfChanges": 2,
|
||||
"new": [],
|
||||
"updated": [
|
||||
"fetchTime": "2026-11-12T00:50:30.803Z",
|
||||
"numberOfChanges": 1,
|
||||
"new": [
|
||||
{
|
||||
"cveId": "CVE-2026-33818",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33818.json",
|
||||
"dateUpdated": "2026-11-11T23:22:46.596Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-42504",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42504.json",
|
||||
"dateUpdated": "2026-11-11T23:22:44.538Z"
|
||||
"cveId": "CVE-2026-126673",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126673",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126673.json",
|
||||
"dateUpdated": "2026-11-12T00:44:34.065Z"
|
||||
}
|
||||
],
|
||||
"updated": [],
|
||||
"error": []
|
||||
}
|
||||
+71
-70
@@ -1,4 +1,75 @@
|
||||
[
|
||||
{
|
||||
"fetchTime": "2026-11-12T00:50:30.803Z",
|
||||
"numberOfChanges": 1,
|
||||
"new": [
|
||||
{
|
||||
"cveId": "CVE-2026-126673",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126673",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126673.json",
|
||||
"dateUpdated": "2026-11-12T00:44:34.065Z"
|
||||
}
|
||||
],
|
||||
"updated": [],
|
||||
"error": []
|
||||
},
|
||||
{
|
||||
"fetchTime": "2026-11-12T00:34:38.963Z",
|
||||
"numberOfChanges": 8,
|
||||
"new": [
|
||||
{
|
||||
"cveId": "CVE-2026-125785",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125785",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125785.json",
|
||||
"dateUpdated": "2026-11-12T00:13:02.392Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-125786",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125786",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125786.json",
|
||||
"dateUpdated": "2026-11-12T00:12:01.381Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-125787",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-125787",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/125xxx/CVE-2026-125787.json",
|
||||
"dateUpdated": "2026-11-12T00:10:32.490Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-126785",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-126785",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/126xxx/CVE-2026-126785.json",
|
||||
"dateUpdated": "2026-11-12T00:30:24.749Z"
|
||||
}
|
||||
],
|
||||
"updated": [
|
||||
{
|
||||
"cveId": "CVE-2026-108472",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108472",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108472.json",
|
||||
"dateUpdated": "2026-11-12T00:12:25.032Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-121529",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121529",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121529.json",
|
||||
"dateUpdated": "2026-11-12T00:04:36.559Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-124308",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124308",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124308.json",
|
||||
"dateUpdated": "2026-11-12T00:12:26.454Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-124309",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124309",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124309.json",
|
||||
"dateUpdated": "2026-11-12T00:12:27.908Z"
|
||||
}
|
||||
],
|
||||
"error": []
|
||||
},
|
||||
{
|
||||
"fetchTime": "2026-11-11T23:24:17.911Z",
|
||||
"numberOfChanges": 2,
|
||||
@@ -848600,75 +848671,5 @@
|
||||
}
|
||||
],
|
||||
"error": []
|
||||
},
|
||||
{
|
||||
"fetchTime": "2026-10-12T23:45:32.556Z",
|
||||
"numberOfChanges": 1,
|
||||
"new": [
|
||||
{
|
||||
"cveId": "CVE-2026-108941",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108941",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108941.json",
|
||||
"dateUpdated": "2026-10-12T23:45:18.670Z"
|
||||
}
|
||||
],
|
||||
"updated": [],
|
||||
"error": []
|
||||
},
|
||||
{
|
||||
"fetchTime": "2026-10-12T23:33:41.860Z",
|
||||
"numberOfChanges": 8,
|
||||
"new": [
|
||||
{
|
||||
"cveId": "CVE-2026-108940",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-108940",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108940.json",
|
||||
"dateUpdated": "2026-10-12T23:30:17.247Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17484",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17484",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17484.json",
|
||||
"dateUpdated": "2026-10-12T23:22:51.749Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-17487",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-17487",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17487.json",
|
||||
"dateUpdated": "2026-10-12T23:22:49.725Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-18318",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18318",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18318.json",
|
||||
"dateUpdated": "2026-10-12T23:22:30.726Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-18343",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-18343",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18343.json",
|
||||
"dateUpdated": "2026-10-12T23:22:29.288Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-81858",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-81858",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81858.json",
|
||||
"dateUpdated": "2026-10-12T23:22:27.442Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-93886",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-93886",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93886.json",
|
||||
"dateUpdated": "2026-10-12T23:22:16.102Z"
|
||||
},
|
||||
{
|
||||
"cveId": "CVE-2026-96119",
|
||||
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-96119",
|
||||
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96119.json",
|
||||
"dateUpdated": "2026-10-12T23:22:11.872Z"
|
||||
}
|
||||
],
|
||||
"updated": [],
|
||||
"error": []
|
||||
}
|
||||
]
|
||||
Reference in New Issue
Block a user