CVE sync 2026-11-13T11:30:11Z
This commit is contained in:
Vulnerability Bot committed
1 parent
5cb9173b05
commit
a85a5da82c
10 files changed
+974
-854
No files matched your search
@@ -0,0 +1,169 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-109903",
|
||||
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "suse",
|
||||
"dateReserved": "2026-10-13T09:50:30.689Z",
|
||||
"datePublished": "2026-11-13T10:50:09.683Z",
|
||||
"dateUpdated": "2026-11-13T10:50:09.683Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
|
||||
"shortName": "suse",
|
||||
"dateUpdated": "2026-11-13T10:50:09.683Z"
|
||||
},
|
||||
"title": "X.Org Server XvQueryImageAttributes Negative Size Reply",
|
||||
"datePublic": "2026-11-13T10:35:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-191",
|
||||
"description": "CWE-191 Integer underflow (wrap or wraparound)",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-100",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-100 Overflow Buffers"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "X.Org",
|
||||
"product": "xwayland",
|
||||
"packageName": "xwayland",
|
||||
"repo": "https://gitlab.freedesktop.org/xorg/xserver/",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "24.1.15",
|
||||
"versionType": "rpm"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "X.Org",
|
||||
"product": "xorg-x11-server",
|
||||
"packageName": "xorg-x11-server",
|
||||
"repo": "https://gitlab.freedesktop.org/xorg/xserver/",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "21.1.26",
|
||||
"versionType": "rpm"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpeApplicability": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "24.1.15"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "21.1.26"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland before 24.1.15 could be used to causes crashes by authenticated X clients.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "A buffer overread caused by casting a negative integer to CARD32 in <span>XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland before 24.1.15 could be used to causes crashes by authenticated X clients.</span>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/a11d070e4ea78c6c97a7e88c57277d766cd9050b",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.8,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Tristan Madani <TristanInSec@gmail.com>",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,179 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-109904",
|
||||
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "suse",
|
||||
"dateReserved": "2026-10-13T09:50:30.690Z",
|
||||
"datePublished": "2026-11-13T10:27:48.418Z",
|
||||
"dateUpdated": "2026-11-13T10:27:48.418Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
|
||||
"shortName": "suse",
|
||||
"dateUpdated": "2026-11-13T10:27:48.418Z"
|
||||
},
|
||||
"title": "X.Org Server XRes QueryClientIds Request Size Overflow",
|
||||
"datePublic": "2026-11-13T10:18:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-126",
|
||||
"description": "CWE-126 Buffer over-read",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-540",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-540 Overread Buffers"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "X.Org",
|
||||
"product": "xorg-x11-server",
|
||||
"packageName": "xorg-x11-server",
|
||||
"repo": "https://gitlab.freedesktop.org/xorg/xserver/",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "21.1.26",
|
||||
"versionType": "rpm"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "X.Org",
|
||||
"product": "xwayland",
|
||||
"packageName": "xwayland",
|
||||
"repo": "https://gitlab.freedesktop.org/xorg/xserver/",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThan": "24.1.15",
|
||||
"versionType": "rpm"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpeApplicability": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:x.org:xorg-x11-server:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "21.1.26"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "0",
|
||||
"versionEndExcluding": "24.1.15"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by attackers on authenticated X clients to crash the server or leak out information.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "A buffer overread caused by an integer-overflow in <span>Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by attackers on authenticated X clients to crash the server or leak out information.</span>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/ff754b812597177412f2e2fa2b1dd1eecbeb75cf",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "LOW",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "NONE",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 6.9,
|
||||
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Acts1631 <acts1631kjv@proton.me>",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,21 +8,21 @@
|
||||
"assignerShortName": "apache",
|
||||
"dateReserved": "2026-11-04T17:30:04.549Z",
|
||||
"datePublished": "2026-11-11T12:13:53.275Z",
|
||||
"dateUpdated": "2026-11-11T13:09:23.609Z"
|
||||
"dateUpdated": "2026-11-13T10:37:21.852Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
|
||||
"shortName": "apache",
|
||||
"dateUpdated": "2026-11-11T12:13:53.275Z"
|
||||
"dateUpdated": "2026-11-13T10:37:21.852Z"
|
||||
},
|
||||
"title": "Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted sketch images",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"description": "CWE-400",
|
||||
"description": "CWE-400 Uncontrolled Resource Consumption",
|
||||
"lang": "en",
|
||||
"cweId": "CWE-400",
|
||||
"type": "CWE"
|
||||
|
||||
@@ -0,0 +1,136 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-123274",
|
||||
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "apache",
|
||||
"dateReserved": "2026-11-05T18:25:08.447Z",
|
||||
"datePublished": "2026-11-13T10:34:29.123Z",
|
||||
"dateUpdated": "2026-11-13T11:07:40.219Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
|
||||
"shortName": "apache",
|
||||
"dateUpdated": "2026-11-13T10:34:29.123Z"
|
||||
},
|
||||
"title": "Apache DataSketches C++: Out-of-bounds write in KLL sketch deserialization allows memory corruption via a crafted sketch",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"description": "CWE-787, Out-of-bounds Write",
|
||||
"lang": "en",
|
||||
"cweId": "CWE-787",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Apache Software Foundation",
|
||||
"product": "Apache DataSketches C++",
|
||||
"packageURL": "pkg:github/apache/datasketches-cpp",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0-incubating",
|
||||
"lessThanOrEqual": "5.3.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected",
|
||||
"collectionURL": "https://github.com",
|
||||
"packageName": "apache/datasketches-cpp"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"value": "Out-of-bounds Write vulnerability in Apache DataSketches C++. An\n application that deserializes a KLL sketch from an untrusted source\n can have heap memory corrupted by a crafted sketch, because the\n serialized level boundaries were not validated.\n\n This issue affects Apache DataSketches C++: 2.0.0 through 5.3.0.\n\n Users are recommended to upgrade to version 5.3.1, which fixes the\n issue.",
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Out-of-bounds Write vulnerability in Apache DataSketches C++. An<br> application that deserializes a KLL sketch from an untrusted source<br> can have heap memory corrupted by a crafted sketch, because the<br> serialized level boundaries were not validated.<br><br> This issue affects Apache DataSketches C++: 2.0.0 through 5.3.0.<br><br> Users are recommended to upgrade to version 5.3.1, which fixes the<br> issue."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://lists.apache.org/thread/t4rngyg9cbv1b42f1d0crgpgtpby0594",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/apache/datasketches-cpp/releases/tag/5.3.1",
|
||||
"tags": [
|
||||
"release-notes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/apache/datasketches-cpp/commit/bb86d439db494e3d362e54cc4f83481893974335",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/apache/datasketches-cpp/pull/568",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "Textual description of severity",
|
||||
"content": {
|
||||
"text": "moderate"
|
||||
}
|
||||
},
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "hataehoon",
|
||||
"type": "reporter"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.3"
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"title": "CVE Program Container",
|
||||
"references": [
|
||||
{
|
||||
"url": "http://www.openwall.com/lists/oss-security/2026/11/13/1"
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||||
"shortName": "CVE",
|
||||
"dateUpdated": "2026-11-13T11:07:40.219Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,129 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-123338",
|
||||
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "apache",
|
||||
"dateReserved": "2026-11-05T18:41:24.720Z",
|
||||
"datePublished": "2026-11-13T10:32:43.404Z",
|
||||
"dateUpdated": "2026-11-13T11:07:42.270Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
|
||||
"shortName": "apache",
|
||||
"dateUpdated": "2026-11-13T10:32:43.404Z"
|
||||
},
|
||||
"title": "Apache DataSketches C++: Out-of-bounds write in REQ sketch deserialization allows memory corruption via a crafted sketch",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"description": "CWE-787, Out-of-bounds Write",
|
||||
"lang": "en",
|
||||
"cweId": "CWE-787",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "INTERNAL"
|
||||
},
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Apache Software Foundation",
|
||||
"product": "Apache DataSketches C++",
|
||||
"packageURL": "pkg:github/apache/datasketches-cpp",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "3.0.0",
|
||||
"lessThanOrEqual": "5.3.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected",
|
||||
"collectionURL": "https://github.com",
|
||||
"packageName": "apache/datasketches-cpp"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"value": "Out-of-bounds Write vulnerability in Apache DataSketches C++. An\n application that deserializes a REQ sketch from an untrusted source\n can have heap memory corrupted by a crafted sketch, because the\n serialized compactor headers were not validated.\n\n This issue affects Apache DataSketches C++: from 3.0.0 through 5.3.0.\n\n Users are recommended to upgrade to version 5.3.1, which fixes the\n issue.",
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Out-of-bounds Write vulnerability in Apache DataSketches C++. An<br> application that deserializes a REQ sketch from an untrusted source<br> can have heap memory corrupted by a crafted sketch, because the<br> serialized compactor headers were not validated.<br><br> This issue affects Apache DataSketches C++: from 3.0.0 through 5.3.0.<br><br> Users are recommended to upgrade to version 5.3.1, which fixes the<br> issue."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://lists.apache.org/thread/wjsso4wl0f0nczwh7gd74kc5wckn1635",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/apache/datasketches-cpp/releases/tag/5.3.1",
|
||||
"tags": [
|
||||
"release-notes"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/apache/datasketches-cpp/commit/9839ffd2ccc038d453e38b545750a5ed2d589dea",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/apache/datasketches-cpp/pull/568",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "Textual description of severity",
|
||||
"content": {
|
||||
"text": "moderate"
|
||||
}
|
||||
},
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.3"
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"title": "CVE Program Container",
|
||||
"references": [
|
||||
{
|
||||
"url": "http://www.openwall.com/lists/oss-security/2026/11/13/2"
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||||
"shortName": "CVE",
|
||||
"dateUpdated": "2026-11-13T11:07:42.270Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,239 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-125659",
|
||||
"assignerOrgId": "66834db9-ab24-42b4-be80-296b2e40335c",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "CERT-In",
|
||||
"dateReserved": "2026-11-10T08:12:07.047Z",
|
||||
"datePublished": "2026-11-13T10:17:45.806Z",
|
||||
"dateUpdated": "2026-11-13T10:17:45.806Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "66834db9-ab24-42b4-be80-296b2e40335c",
|
||||
"shortName": "CERT-In",
|
||||
"dateUpdated": "2026-11-13T10:17:45.806Z"
|
||||
},
|
||||
"title": "Information Disclosure Vulnerability in eMudhra emBridge",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-862",
|
||||
"description": "CWE-862 Missing Authorization",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-127",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-127 Directory Indexing"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "eMudhra",
|
||||
"product": "emBridge",
|
||||
"platforms": [
|
||||
"Windows"
|
||||
],
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "version 5.9.1.x to 5.9.3.x"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "eMudhra",
|
||||
"product": "emBridge",
|
||||
"platforms": [
|
||||
"MacOS"
|
||||
],
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "version 3.2.4.x to 3.2.6.x"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "eMudhra",
|
||||
"product": "emBridge",
|
||||
"platforms": [
|
||||
"Ubuntu"
|
||||
],
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "version 3.2.0.x to 3.3.0.x"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "eMudhra",
|
||||
"product": "emBridge",
|
||||
"platforms": [
|
||||
"Red Hat"
|
||||
],
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "version 3.2.0.x to 3.3.0.x"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpeApplicability": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:emudhra:embridge:version_5.9.1.x_to_5.9.3.x:*:windows:*:*:*:*:*"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:emudhra:embridge:version_3.2.4.x_to_3.2.6.x:*:macos:*:*:*:*:*"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:emudhra:embridge:version_3.2.0.x_to_3.3.0.x:*:ubuntu:*:*:*:*:*"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:emudhra:embridge:version_3.2.0.x_to_3.3.0.x:*:red_hat:*:*:*:*:*"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on the same LAN could exploit this vulnerability by sending malicious webpage to the local HTTPS Web API.\n\n \n\nSuccessful exploitation of this vulnerability could allow the attacker to enumerate file and directory names and obtain information about the directory structure of the targeted system. \n\n\n\nThe vulnerability however, does not provide access to file contents or permit file modification, deletion, or code execution, or access to cryptographic keys and hardware token PINs.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on the same LAN could exploit this vulnerability by sending malicious webpage to the local HTTPS Web API.\n<br> \n<br>Successful exploitation of this vulnerability could allow the attacker to enumerate file and directory names and obtain information about the directory structure of the targeted system. \n<br>\n<br>The vulnerability however, does not provide access to file contents or permit file modification, deletion, or code execution, or access to cryptographic keys and hardware token PINs. <br>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0549",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://emudhra.com/en/post/cve-2026-125659",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "ADJACENT",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "PRESENT",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "PASSIVE",
|
||||
"vulnConfidentialityImpact": "LOW",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "NONE",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "NONE",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "LOW",
|
||||
"baseScore": 2.1,
|
||||
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Upgrade eMudhra emBridge to latest versions:\n\n\n\n•\teMudhra emBridge for Windows to version 5.9.4.x or later\n\n•\teMudhra emBridge for macOS (x64) to version 3.2.7.x or later\n\n•\teMudhra emBridge for Ubuntu (x64) to version 3.3.1.x or later\n\n•\teMudhra emBridge for Red Hat (x64) to version 3.3.1.x or later",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Upgrade eMudhra emBridge to latest versions:\n<br>\n<br>•\teMudhra emBridge for Windows to version 5.9.4.x or later\n<br>•\teMudhra emBridge for macOS (x64) to version 3.2.7.x or later\n<br>•\teMudhra emBridge for Ubuntu (x64) to version 3.3.1.x or later\n<br>•\teMudhra emBridge for Red Hat (x64) to version 3.3.1.x or later <br>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "This vulnerability is reported by Karan Saini",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "fortinet",
|
||||
"dateReserved": "2026-11-10T20:07:56.227Z",
|
||||
"datePublished": "2026-11-11T21:31:03.916Z",
|
||||
"dateUpdated": "2026-11-12T19:07:14.408Z"
|
||||
"dateUpdated": "2026-11-13T11:05:09.836Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -293,7 +293,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
|
||||
"shortName": "fortinet",
|
||||
"dateUpdated": "2026-11-11T21:31:03.916Z"
|
||||
"dateUpdated": "2026-11-13T11:05:09.836Z"
|
||||
},
|
||||
"problemTypes": [
|
||||
{
|
||||
|
||||
Reference in new issue
Block a user