CVE sync 2026-11-12T07:37:15Z
This commit is contained in:
Vulnerability Bot
@@ -0,0 +1,125 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-113408",
|
||||
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "GitLab",
|
||||
"dateReserved": "2026-10-20T06:03:58.616Z",
|
||||
"datePublished": "2026-11-12T07:09:19.100Z",
|
||||
"dateUpdated": "2026-11-12T07:09:19.100Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Git",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Git",
|
||||
"product": "Git",
|
||||
"repo": "https://gitlab.com/git-scm/git",
|
||||
"cpes": [
|
||||
"cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"
|
||||
],
|
||||
"versions": [
|
||||
{
|
||||
"version": "2.50.1",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.51.2",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.52.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.53.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.54.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.55.0",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "2.56.0",
|
||||
"status": "affected"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unknown"
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
|
||||
"cweId": "CWE-22",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://gitlab.com/gitlab-org/git/-/work_items/809"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 3.3,
|
||||
"baseSeverity": "LOW"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "ehdgks0627, un3xploitable",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
|
||||
"shortName": "GitLab",
|
||||
"dateUpdated": "2026-11-12T07:09:19.100Z"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,204 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-12507",
|
||||
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Zohocorp",
|
||||
"dateReserved": "2026-06-17T10:49:52.198Z",
|
||||
"datePublished": "2026-11-12T06:48:54.703Z",
|
||||
"dateUpdated": "2026-11-12T06:48:54.703Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"shortName": "Zohocorp",
|
||||
"dateUpdated": "2026-11-12T06:48:54.703Z"
|
||||
},
|
||||
"title": "Authenticated remote code execution",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-89",
|
||||
"description": "CWE-89 – SQL Injection",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-242",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-242 – Code Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Zohocorp",
|
||||
"product": "AssetExplorer",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "7860",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "Zohocorp",
|
||||
"product": "ServiceDesk Plus",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "15290",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "Zohocorp",
|
||||
"product": "ServiceDesk Plus MSP",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "15150",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "Zohocorp",
|
||||
"product": "SupportCenter Plus",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "15150",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpeApplicability": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:zohocorp:assetexplorer:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "7860"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:zohocorp:servicedesk_plus:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "15290"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:zohocorp:servicedesk_plus_msp:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "15150"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:zohocorp:supportcenter_plus:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "15150"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<span>Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the </span><span><span>Create Query Reports</span></span><span> permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.</span>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.manageengine.com/products/service-desk/cve-2026-12507.html"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "CRITICAL",
|
||||
"baseScore": 9.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,129 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-12591",
|
||||
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Zohocorp",
|
||||
"dateReserved": "2026-06-18T09:09:27.284Z",
|
||||
"datePublished": "2026-11-12T06:55:31.695Z",
|
||||
"dateUpdated": "2026-11-12T06:55:31.695Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
|
||||
"shortName": "Zohocorp",
|
||||
"dateUpdated": "2026-11-12T06:55:31.695Z"
|
||||
},
|
||||
"title": "Privilege Escalation",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-862",
|
||||
"description": "CWE-862 – Missing Authorization",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-122",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-122 – Privilege Abuse"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Zohocorp",
|
||||
"product": "M365 Manager Plus",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "4818",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpeApplicability": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:zohocorp:m365_manager_plus:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "4818"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<span>Zohocorp ManageEngine </span>M365 Manager Plus<span> versions below </span>4818<span> is affected by </span>an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.manageengine.com/microsoft-365-management-reporting/CVE-2026-12591.html"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "CRITICAL",
|
||||
"baseScore": 9.9,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,125 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-87772",
|
||||
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "TR-CERT",
|
||||
"dateReserved": "2026-09-09T08:22:44.834Z",
|
||||
"datePublished": "2026-11-12T06:35:54.306Z",
|
||||
"dateUpdated": "2026-11-12T06:35:54.306Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
|
||||
"shortName": "TR-CERT",
|
||||
"dateUpdated": "2026-11-12T06:35:54.306Z"
|
||||
},
|
||||
"title": "Unauthenticated Polkit Privilege Escalation in TÜBİTAK BİLGEM's Pardus About",
|
||||
"datePublic": "2026-11-12T06:32:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-863",
|
||||
"description": "CWE-863 Incorrect Authorization",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-233",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-233 Privilege Escalation"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "TÜBİTAK BİLGEM Software Technologies Research Institute",
|
||||
"product": "Pardus About",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "1.2.5",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows Privilege Escalation.\n\nThis issue affects Pardus About: before 1.2.5.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows Privilege Escalation.<p>This issue affects Pardus About: before 1.2.5.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1521",
|
||||
"tags": [
|
||||
"government-resource"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.8,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Sevban DÖNMEZ",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"defect": [
|
||||
"TR-26-1521"
|
||||
],
|
||||
"advisory": "TR-26-1521",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,199 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-8331",
|
||||
"assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Microchip",
|
||||
"dateReserved": "2026-05-11T15:27:37.104Z",
|
||||
"datePublished": "2026-11-12T06:21:04.118Z",
|
||||
"dateUpdated": "2026-11-12T06:26:09.676Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
|
||||
"shortName": "Microchip",
|
||||
"dateUpdated": "2026-11-12T06:26:09.676Z"
|
||||
},
|
||||
"title": "TimePictra ermote code execution via file upload",
|
||||
"datePublic": "2026-11-12T06:20:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-434",
|
||||
"description": "CWE-434 Unrestricted upload of file with dangerous type",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-1",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Microchip",
|
||||
"product": "TimePictra",
|
||||
"collectionURL": "https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "12.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<span>An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution.</span>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.gruppotim.it/en/footer/TIM-red-team.html",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "PRESENT",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "ACTIVE",
|
||||
"vulnConfidentialityImpact": "HIGH",
|
||||
"subConfidentialityImpact": "HIGH",
|
||||
"vulnIntegrityImpact": "HIGH",
|
||||
"subIntegrityImpact": "HIGH",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "HIGH",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Upgrade to TimePictra 12.0 platform or later",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<div><div><div><div><div><div><div><p></p><div><p>Upgrade to TimePictra 12.0 platform or later</p></div></div></div></div></div></div></div></div>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"time": "2026-04-09T13:36:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "Initial report"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Dario Emilio Bertani",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Andrea Sindoni",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Antonio Carriero",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Marco Manieri",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Vito Pistillo",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Davide Renna",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Renna Leone",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Massimiliano Brolli",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "TIM Security Red Team Research",
|
||||
"type": "reporter"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "PSIRT-137",
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,199 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-8332",
|
||||
"assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Microchip",
|
||||
"dateReserved": "2026-05-11T15:27:51.427Z",
|
||||
"datePublished": "2026-11-12T06:19:49.994Z",
|
||||
"dateUpdated": "2026-11-12T06:30:02.426Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
|
||||
"shortName": "Microchip",
|
||||
"dateUpdated": "2026-11-12T06:30:02.426Z"
|
||||
},
|
||||
"title": "TimePictra root password hardcoded in installation files",
|
||||
"datePublic": "2026-11-12T06:29:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-798",
|
||||
"description": "CWE-798",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-205",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-205"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Microchip",
|
||||
"product": "TimePictra",
|
||||
"collectionURL": "https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "12.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those files to obtain privileged credentials",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<span>A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those files to obtain privileged credentials</span>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-root-password-hardcoded-in-installation-files",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.gruppotim.it/en/footer/TIM-red-team.html",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackRequirements": "PRESENT",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "ACTIVE",
|
||||
"vulnConfidentialityImpact": "HIGH",
|
||||
"subConfidentialityImpact": "HIGH",
|
||||
"vulnIntegrityImpact": "HIGH",
|
||||
"subIntegrityImpact": "HIGH",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "HIGH",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Upgrade to TimePictra 12.0 platform or later",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Upgrade to TimePictra 12.0 platform or later"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"time": "2026-04-09T13:36:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "Initial report"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Dario Emilio Bertani",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Andrea Sindoni",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Antonio Carriero",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Marco Manieri",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Vito Pistillo",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Davide Renna",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Renna Leone",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Massimiliano Brolli",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "TIM Security Red Team Research",
|
||||
"type": "reporter"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "PSIRT-138",
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,199 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-8333",
|
||||
"assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Microchip",
|
||||
"dateReserved": "2026-05-11T15:28:04.746Z",
|
||||
"datePublished": "2026-11-12T06:18:29.144Z",
|
||||
"dateUpdated": "2026-11-12T06:30:50.933Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
|
||||
"shortName": "Microchip",
|
||||
"dateUpdated": "2026-11-12T06:30:50.933Z"
|
||||
},
|
||||
"title": "TimePictra Stored Cross-site Scripting",
|
||||
"datePublic": "2026-11-12T06:17:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-79",
|
||||
"description": "CWE-79",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-63",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-63"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Microchip",
|
||||
"product": "TimePictra",
|
||||
"collectionURL": "https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "12.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<span>A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page</span>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-stored-cross-site-scripting-vulnerability",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.gruppotim.it/en/footer/TIM-red-team.html",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "PASSIVE",
|
||||
"vulnConfidentialityImpact": "HIGH",
|
||||
"subConfidentialityImpact": "HIGH",
|
||||
"vulnIntegrityImpact": "HIGH",
|
||||
"subIntegrityImpact": "HIGH",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "HIGH",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "CRITICAL",
|
||||
"baseScore": 9.4,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Upgrade to TimePictra 12.0 platform or later",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<div><div><div><div><div><div><div><p></p><div><p>Upgrade to TimePictra 12.0 platform or later</p></div></div></div></div></div></div></div></div>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"time": "2026-04-09T13:36:00.000Z",
|
||||
"lang": "en",
|
||||
"value": "Initial report"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Dario Emilio Bertani",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Andrea Sindoni",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Antonio Carriero",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Marco Manieri",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Vito Pistillo",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Davide Renna",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Renna Leone",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Massimiliano Brolli",
|
||||
"type": "finder"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "TIM Security Red Team Research",
|
||||
"type": "reporter"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"advisory": "PSIRT-139",
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,52 +8,43 @@
|
||||
"assignerShortName": "Patchstack",
|
||||
"dateReserved": "2026-09-23T17:30:22.499Z",
|
||||
"datePublished": "2026-09-30T12:27:45.550Z",
|
||||
"dateUpdated": "2026-09-30T13:27:13.706Z"
|
||||
"dateUpdated": "2026-11-12T06:58:58.882Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
|
||||
"shortName": "Patchstack",
|
||||
"dateUpdated": "2026-09-30T12:27:45.550Z"
|
||||
"dateUpdated": "2026-11-12T06:58:58.882Z"
|
||||
},
|
||||
"title": "WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability",
|
||||
"problemTypes": [
|
||||
"datePublic": "2026-09-24T11:15:30.000Z",
|
||||
"descriptions": [
|
||||
{
|
||||
"descriptions": [
|
||||
"lang": "en",
|
||||
"value": "Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Retrieve Embedded Sensitive Data.This issue affects GiveWP: from n/a through 4.16.9.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-862",
|
||||
"description": "CWE-862 Missing Authorization",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-37",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Retrieve Embedded Sensitive Data.<p>This issue affects GiveWP: from n/a through 4.16.9.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Nexcess",
|
||||
"vendor": "Liquid Web / StellarWP",
|
||||
"product": "GiveWP",
|
||||
"packageName": "give",
|
||||
"collectionURL": "https://wordpress.org/plugins",
|
||||
"defaultStatus": "unaffected",
|
||||
"packageName": "give",
|
||||
"product": "GiveWP",
|
||||
"versions": [
|
||||
{
|
||||
"lessThanOrEqual": "4.16.9",
|
||||
"status": "affected",
|
||||
"version": "n/a",
|
||||
"version": "0",
|
||||
"versionType": "custom",
|
||||
"status": "affected",
|
||||
"lessThanOrEqual": "4.16.9",
|
||||
"changes": [
|
||||
{
|
||||
"at": "4.17.0",
|
||||
@@ -64,25 +55,19 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions."
|
||||
}
|
||||
],
|
||||
"value": "Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions."
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-9-sensitive-data-exposure-vulnerability?_s_id=cve",
|
||||
"tags": [
|
||||
"vdb-entry"
|
||||
],
|
||||
"url": "https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-9-sensitive-data-exposure-vulnerability?_s_id=cve"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Intrudify | Patchstack Bug Bounty Program",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
@@ -95,6 +80,10 @@
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||
"baseScore": 6.5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
@@ -102,41 +91,50 @@
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"version": "3.1",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 6.5,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
|
||||
"availabilityImpact": "NONE"
|
||||
}
|
||||
}
|
||||
],
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-862",
|
||||
"description": "Missing Authorization",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-37",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Retrieve Embedded Sensitive Data"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Update the WordPress GiveWP plugin to the latest available version (at least 4.17.0).",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Update the WordPress GiveWP plugin to the latest available version (at least 4.17.0)."
|
||||
}
|
||||
],
|
||||
"value": "Update the WordPress GiveWP plugin to the latest available version (at least 4.17.0)."
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"type": "finder",
|
||||
"user": "00000000-0000-4000-9000-000000000000",
|
||||
"value": "Intrudify | Patchstack Bug Bounty Program"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
}
|
||||
"tags": [
|
||||
"x_known-exploited-vulnerability",
|
||||
"x_open-source"
|
||||
]
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user