CVE sync 2026-11-13T22:30:43Z
This commit is contained in:
Vulnerability Bot committed
1 parent
aa65f0c147
commit
c1444140e5
61 files changed
+6438
-713
No files matched your search
@@ -0,0 +1,163 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-9661",
|
||||
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "VulnCheck",
|
||||
"dateReserved": "2026-05-26T21:50:46.277Z",
|
||||
"datePublished": "2026-11-13T21:40:35.827Z",
|
||||
"dateUpdated": "2026-11-13T22:10:14.165Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
|
||||
"shortName": "VulnCheck",
|
||||
"dateUpdated": "2026-11-13T21:41:13.780Z"
|
||||
},
|
||||
"title": "Postecert FIRMAOK! 1.6.29 Local Privilege Escalation via OpenSSL Search Path",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Poste Italiane Postecert FIRMAOK! 1.6.29 on Windows contains a local privilege escalation vulnerability caused by an uncontrolled OpenSSL search path, where launcher.exe and dependent executables such as updater.exe and tslupdater.exe load OpenSSL configuration and library files from a hardcoded, user-writable directory that does not exist by default. A low-privileged local attacker can create this missing directory and place malicious OpenSSL configuration or library files inside it, causing the application to load and execute attacker-controlled code with the privileges of the user running it, enabling horizontal or, when a higher-privileged user runs the application, vertical privilege escalation up to full system compromise."
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-13T00:00:00.000Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Uncontrolled Search Path Element",
|
||||
"cweId": "CWE-427",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"defaultStatus": "unknown",
|
||||
"vendor": "Poste Italiane",
|
||||
"product": "Postecert FIRMAOK!",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.6.29",
|
||||
"versionType": "semver"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "HIGH",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "HIGH",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "HIGH",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "HIGH",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "NOT_DEFINED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "NOT_DEFINED",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||
"providerUrgency": "NOT_DEFINED",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.3,
|
||||
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
|
||||
}
|
||||
},
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"version": "3.1",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://seclists.org/fulldisclosure/2026/Nov/14",
|
||||
"name": "Researcher Disclosure",
|
||||
"tags": [
|
||||
"technical-description",
|
||||
"exploit"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://postecert.poste.it/firma/download.shtml",
|
||||
"name": "Product Download",
|
||||
"tags": [
|
||||
"product"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://www.vulncheck.com/advisories/postecert-firmaok-local-privilege-escalation-via-openssl-search-path",
|
||||
"name": "VulnCheck Advisory: Postecert FIRMAOK! 1.6.29 Local Privilege Escalation via OpenSSL Search Path",
|
||||
"tags": [
|
||||
"third-party-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Andrea Intilangelo",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "vulncheck"
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"title": "CVE Program Container",
|
||||
"references": [
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2026/Nov/14"
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||||
"shortName": "CVE",
|
||||
"dateUpdated": "2026-11-13T22:10:14.165Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,113 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-9821",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-05-28T11:27:43.155Z",
|
||||
"datePublished": "2026-11-13T21:34:23.559Z",
|
||||
"dateUpdated": "2026-11-13T21:34:23.559Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:34:23.559Z"
|
||||
},
|
||||
"title": "IBM Cyber Fraud includes components with multiple known vulnerabilities",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-117",
|
||||
"description": "CWE-117 Improper Output Neutralization for Logs",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "Cyber Fraud",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"lessThanOrEqual": "1.1.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:cyber_fraud:1.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:cyber_fraud:1.1.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7295966",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly encourages customers to update their systems promptly.\n\n\n\nPlease upgrade to at least version 1.1.1 according to the following instructions:\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud \n\n\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly encourages customers to update their systems promptly.</strong></p><p>Please upgrade to at least version 1.1.1 according to the following instructions:<br/><br/><a href=\"https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud</a></p><p><a href=\"https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud</a></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,113 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-9870",
|
||||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ibm",
|
||||
"dateReserved": "2026-05-28T17:18:38.929Z",
|
||||
"datePublished": "2026-11-13T21:35:56.221Z",
|
||||
"dateUpdated": "2026-11-13T21:35:56.221Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||||
"shortName": "ibm",
|
||||
"dateUpdated": "2026-11-13T21:35:56.221Z"
|
||||
},
|
||||
"title": "IBM Cyber Fraud includes components with multiple known vulnerabilities",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-79",
|
||||
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "IBM",
|
||||
"product": "Cyber Fraud",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "1.0.0",
|
||||
"lessThanOrEqual": "1.1.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:2.3:a:ibm:cyber_fraud:1.0.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:ibm:cyber_fraud:1.1.0:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Cyber Fraud 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>IBM Cyber Fraud 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7295966",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseSeverity": "MEDIUM",
|
||||
"baseScore": 6.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
}
|
||||
],
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM strongly encourages customers to update their systems promptly.\n\n\n\nPlease upgrade to at least version 1.1.1 according to the following instructions:\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud \n\n\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p><strong>IBM strongly encourages customers to update their systems promptly.</strong></p><p>Please upgrade to at least version 1.1.1 according to the following instructions:<br/><br/><a href=\"https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud</a></p><p><a href=\"https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud</a></p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user