CVE sync 2026-11-15T03:32:24Z

This commit is contained in:
Vulnerability Bot committed 2026-11-15 04:32:29 +01:00
1 parent 927af45320
commit 833b6fbb8a
6 files changed
+695 -105

No files matched your search

+227
View File
@@ -0,0 +1,227 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129358",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-14T06:50:09.015Z",
"datePublished": "2026-11-15T02:45:25.095Z",
"dateUpdated": "2026-11-15T02:45:25.095Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-15T02:45:25.095Z"
},
"title": "Linux Foundation Magma NMS routes.ts handleReact cross site scripting",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-79",
"lang": "en",
"description": "Cross Site Scripting"
}
]
},
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-94",
"lang": "en",
"description": "Code Injection"
}
]
}
],
"affected": [
{
"vendor": "Linux Foundation",
"product": "Magma",
"versions": [
{
"version": "1.0",
"status": "affected"
},
{
"version": "1.1",
"status": "affected"
},
{
"version": "1.2",
"status": "affected"
},
{
"version": "1.3",
"status": "affected"
},
{
"version": "1.4",
"status": "affected"
},
{
"version": "1.5",
"status": "affected"
},
{
"version": "1.6",
"status": "affected"
},
{
"version": "1.7",
"status": "affected"
},
{
"version": "1.8",
"status": "affected"
},
{
"version": "1.9.0",
"status": "affected"
}
],
"cpes": [
"cpe:2.3:o:linux_foundation:magma:*:*:*:*:*:*:*:*"
],
"modules": [
"NMS"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Linux Foundation Magma up to 1.9.0. Impacted is the function handleReact of the file nms/server/main/routes.ts of the component NMS. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 4.8,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 2.4,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"baseSeverity": "LOW"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 2.4,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"baseSeverity": "LOW"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:C"
}
}
],
"timeline": [
{
"time": "2026-11-14T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-14T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-14T18:01:22.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "Aymen Benlamari",
"type": "finder"
},
{
"lang": "en",
"value": "aymencdm (VulDB User)",
"type": "reporter"
},
{
"lang": "en",
"value": "aymencdm (VulDB User)",
"type": "analyst"
},
{
"lang": "en",
"value": "VulDB CNA Team",
"type": "coordinator"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/437421",
"name": "VDB-437421 | Linux Foundation Magma NMS routes.ts handleReact cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
]
},
{
"url": "https://vuldb.com/vuln/437421/cti",
"name": "VDB-437421 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-129358",
"name": "CVE-2026-129358 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1044004",
"name": "Submit #1044004 | Magma Magma 1.8.0-era master @ 76d9dc0ebc (tested) Cross Site Scripting",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/aymencdm/magma_pocs/blob/main/02-xss-poc.sh",
"tags": [
"exploit"
]
},
{
"url": "https://www.linuxfoundation.org/",
"tags": [
"product"
]
}
],
"tags": [
"x_open-source"
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
+207
View File
@@ -0,0 +1,207 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129359",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-14T06:50:34.752Z",
"datePublished": "2026-11-15T03:00:23.941Z",
"dateUpdated": "2026-11-15T03:00:23.941Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-15T03:00:23.941Z"
},
"title": "Linux Foundation Magma interceptors.go hard-coded credentials",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-798",
"lang": "en",
"description": "Hard-coded Credentials"
}
]
},
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-259",
"lang": "en",
"description": "Use of Hard-coded Password"
}
]
}
],
"affected": [
{
"vendor": "Linux Foundation",
"product": "Magma",
"versions": [
{
"version": "1.0",
"status": "affected"
},
{
"version": "1.1",
"status": "affected"
},
{
"version": "1.2",
"status": "affected"
},
{
"version": "1.3",
"status": "affected"
},
{
"version": "1.4",
"status": "affected"
},
{
"version": "1.5",
"status": "affected"
},
{
"version": "1.6",
"status": "affected"
},
{
"version": "1.7",
"status": "affected"
},
{
"version": "1.8",
"status": "affected"
},
{
"version": "1.9.0",
"status": "affected"
}
],
"cpes": [
"cpe:2.3:o:linux_foundation:magma:*:*:*:*:*:*:*:*"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Linux Foundation Magma up to 1.9.0. The affected element is an unknown function of the file orc8r/lib/go/registry/interceptors.go. Performing a manipulation results in hard-coded credentials. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 6.9,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 7.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"baseSeverity": "HIGH"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 7.3,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"baseSeverity": "HIGH"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"
}
}
],
"timeline": [
{
"time": "2026-11-14T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-14T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-14T07:55:46.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "aymencdm (VulDB User)",
"type": "reporter"
},
{
"lang": "en",
"value": "VulDB CNA Team",
"type": "coordinator"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/437422",
"name": "VDB-437422 | Linux Foundation Magma interceptors.go hard-coded credentials",
"tags": [
"vdb-entry"
]
},
{
"url": "https://vuldb.com/vuln/437422/cti",
"name": "VDB-437422 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-129359",
"name": "CVE-2026-129359 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1044005",
"name": "Submit #1044005 | Magma Magma 1.8.0-era master @ 76d9dc0ebc (tested); every deployment Hard-coded Credentials",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.linuxfoundation.org/",
"tags": [
"product"
]
}
],
"tags": [
"x_open-source"
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
+211
View File
@@ -0,0 +1,211 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-129360",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-14T06:50:42.670Z",
"datePublished": "2026-11-15T03:15:17.488Z",
"dateUpdated": "2026-11-15T03:15:17.488Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-15T03:15:17.488Z"
},
"title": "Linux Foundation Magma Obsidian REST operator.go authentication spoofing",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-290",
"lang": "en",
"description": "Authentication Bypass by Spoofing"
}
]
},
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-287",
"lang": "en",
"description": "Improper Authentication"
}
]
}
],
"affected": [
{
"vendor": "Linux Foundation",
"product": "Magma",
"versions": [
{
"version": "1.0",
"status": "affected"
},
{
"version": "1.1",
"status": "affected"
},
{
"version": "1.2",
"status": "affected"
},
{
"version": "1.3",
"status": "affected"
},
{
"version": "1.4",
"status": "affected"
},
{
"version": "1.5",
"status": "affected"
},
{
"version": "1.6",
"status": "affected"
},
{
"version": "1.7",
"status": "affected"
},
{
"version": "1.8",
"status": "affected"
},
{
"version": "1.9.0",
"status": "affected"
}
],
"cpes": [
"cpe:2.3:o:linux_foundation:magma:*:*:*:*:*:*:*:*"
],
"modules": [
"Obsidian REST"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Linux Foundation Magma up to 1.9.0. The impacted element is an unknown function of the file orc8r/cloud/go/services/obsidian/access/operator.go of the component Obsidian REST. Executing a manipulation of the argument X-Magma-Client-Cert-Serial can lead to authentication bypass by spoofing. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 6.9,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 7.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"baseSeverity": "HIGH"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 7.3,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"baseSeverity": "HIGH"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C"
}
}
],
"timeline": [
{
"time": "2026-11-14T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-14T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-14T07:55:50.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "aymencdm (VulDB User)",
"type": "reporter"
},
{
"lang": "en",
"value": "VulDB CNA Team",
"type": "coordinator"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/437423",
"name": "VDB-437423 | Linux Foundation Magma Obsidian REST operator.go authentication spoofing",
"tags": [
"vdb-entry",
"technical-description"
]
},
{
"url": "https://vuldb.com/vuln/437423/cti",
"name": "VDB-437423 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-129360",
"name": "CVE-2026-129360 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1044006",
"name": "Submit #1044006 | Magma Magma 1.8.0-era master @ 76d9dc0ebc (tested); non-TLS Authentication Bypass by Spoofing",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://www.linuxfoundation.org/",
"tags": [
"product"
]
}
],
"tags": [
"x_open-source"
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
+5 -5
View File
@@ -1,12 +1,12 @@
{
"fetchTime": "2026-11-15T02:30:58.953Z",
"fetchTime": "2026-11-15T03:16:36.019Z",
"numberOfChanges": 1,
"new": [
{
"cveId": "CVE-2026-129357",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-129357",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/129xxx/CVE-2026-129357.json",
"dateUpdated": "2026-11-15T02:30:25.361Z"
"cveId": "CVE-2026-129360",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-129360",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/129xxx/CVE-2026-129360.json",
"dateUpdated": "2026-11-15T03:15:17.488Z"
}
],
"updated": [],
+42 -97
View File
@@ -1,4 +1,46 @@
[
{
"fetchTime": "2026-11-15T03:16:36.019Z",
"numberOfChanges": 1,
"new": [
{
"cveId": "CVE-2026-129360",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-129360",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/129xxx/CVE-2026-129360.json",
"dateUpdated": "2026-11-15T03:15:17.488Z"
}
],
"updated": [],
"error": []
},
{
"fetchTime": "2026-11-15T03:01:06.745Z",
"numberOfChanges": 1,
"new": [
{
"cveId": "CVE-2026-129359",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-129359",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/129xxx/CVE-2026-129359.json",
"dateUpdated": "2026-11-15T03:00:23.941Z"
}
],
"updated": [],
"error": []
},
{
"fetchTime": "2026-11-15T02:49:24.076Z",
"numberOfChanges": 1,
"new": [
{
"cveId": "CVE-2026-129358",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-129358",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/129xxx/CVE-2026-129358.json",
"dateUpdated": "2026-11-15T02:45:25.095Z"
}
],
"updated": [],
"error": []
},
{
"fetchTime": "2026-11-15T02:30:58.953Z",
"numberOfChanges": 1,
@@ -719786,102 +719828,5 @@
],
"updated": [],
"error": []
},
{
"fetchTime": "2026-10-16T03:16:11.008Z",
"numberOfChanges": 9,
"new": [
{
"cveId": "CVE-2026-111442",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-111442",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111442.json",
"dateUpdated": "2026-10-16T03:09:43.812Z"
}
],
"updated": [
{
"cveId": "CVE-2026-110912",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-110912",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110912.json",
"dateUpdated": "2026-10-16T03:02:31.851Z"
},
{
"cveId": "CVE-2026-76463",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76463",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76463.json",
"dateUpdated": "2026-10-16T03:14:34.646Z"
},
{
"cveId": "CVE-2026-76464",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76464",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76464.json",
"dateUpdated": "2026-10-16T03:13:48.023Z"
},
{
"cveId": "CVE-2026-76467",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76467",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76467.json",
"dateUpdated": "2026-10-16T03:13:38.125Z"
},
{
"cveId": "CVE-2026-76468",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76468",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76468.json",
"dateUpdated": "2026-10-16T03:14:42.233Z"
},
{
"cveId": "CVE-2026-76469",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76469",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76469.json",
"dateUpdated": "2026-10-16T03:14:27.168Z"
},
{
"cveId": "CVE-2026-76470",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76470",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76470.json",
"dateUpdated": "2026-10-16T03:14:03.865Z"
},
{
"cveId": "CVE-2026-76472",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-76472",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76472.json",
"dateUpdated": "2026-10-16T03:14:59.165Z"
}
],
"error": []
},
{
"fetchTime": "2026-10-16T02:58:59.562Z",
"numberOfChanges": 2,
"new": [
{
"cveId": "CVE-2026-109812",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109812",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109812.json",
"dateUpdated": "2026-10-16T02:54:46.573Z"
},
{
"cveId": "CVE-2026-109813",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-109813",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109813.json",
"dateUpdated": "2026-10-16T02:57:52.388Z"
}
],
"updated": [],
"error": []
},
{
"fetchTime": "2026-10-16T02:40:44.563Z",
"numberOfChanges": 1,
"new": [
{
"cveId": "CVE-2026-100159",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-100159",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100159.json",
"dateUpdated": "2026-10-16T02:26:09.256Z"
}
],
"updated": [],
"error": []
}
]