-
Notifications
You must be signed in to change notification settings - Fork 16
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Auto-Update: 2024-10-14T22:00:16.837568+00:00
- Loading branch information
1 parent
1a4c7df
commit 2a2c8ed
Showing
9 changed files
with
365 additions
and
37 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| { | ||
| "id": "CVE-2024-48821", | ||
| "sourceIdentifier": "[email protected]", | ||
| "published": "2024-10-14T21:15:11.710", | ||
| "lastModified": "2024-10-14T21:15:11.710", | ||
| "vulnStatus": "Received", | ||
| "cveTags": [], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "Cross Site Scripting vulnerability in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges via the FtpConfig.php component." | ||
| } | ||
| ], | ||
| "metrics": {}, | ||
| "references": [ | ||
| { | ||
| "url": "https://daly.wtf/multiple-vulnerabilities-discovered-in-automatic-systems-software/", | ||
| "source": "[email protected]" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| { | ||
| "id": "CVE-2024-48822", | ||
| "sourceIdentifier": "[email protected]", | ||
| "published": "2024-10-14T21:15:11.813", | ||
| "lastModified": "2024-10-14T21:15:11.813", | ||
| "vulnStatus": "Received", | ||
| "cveTags": [], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "Privilege escalation in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges via the FtpConfig.php page." | ||
| } | ||
| ], | ||
| "metrics": {}, | ||
| "references": [ | ||
| { | ||
| "url": "https://daly.wtf/multiple-vulnerabilities-discovered-in-automatic-systems-software/", | ||
| "source": "[email protected]" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| { | ||
| "id": "CVE-2024-48823", | ||
| "sourceIdentifier": "[email protected]", | ||
| "published": "2024-10-14T21:15:11.903", | ||
| "lastModified": "2024-10-14T21:15:11.903", | ||
| "vulnStatus": "Received", | ||
| "cveTags": [], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "Local file inclusion in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges via the PassageAutoServer.php page." | ||
| } | ||
| ], | ||
| "metrics": {}, | ||
| "references": [ | ||
| { | ||
| "url": "https://daly.wtf/multiple-vulnerabilities-discovered-in-automatic-systems-software/", | ||
| "source": "[email protected]" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| { | ||
| "id": "CVE-2024-48824", | ||
| "sourceIdentifier": "[email protected]", | ||
| "published": "2024-10-14T21:15:11.997", | ||
| "lastModified": "2024-10-14T21:15:11.997", | ||
| "vulnStatus": "Received", | ||
| "cveTags": [], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "An issue in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to obtain sensitive information via the Racine & FileName parameters in the download-file.php component." | ||
| } | ||
| ], | ||
| "metrics": {}, | ||
| "references": [ | ||
| { | ||
| "url": "https://daly.wtf/multiple-vulnerabilities-discovered-in-automatic-systems-software/", | ||
| "source": "[email protected]" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| { | ||
| "id": "CVE-2024-48909", | ||
| "sourceIdentifier": "[email protected]", | ||
| "published": "2024-10-14T21:15:12.080", | ||
| "lastModified": "2024-10-14T21:15:12.080", | ||
| "vulnStatus": "Received", | ||
| "cveTags": [], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`." | ||
| } | ||
| ], | ||
| "metrics": { | ||
| "cvssMetricV31": [ | ||
| { | ||
| "source": "[email protected]", | ||
| "type": "Secondary", | ||
| "cvssData": { | ||
| "version": "3.1", | ||
| "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", | ||
| "attackVector": "NETWORK", | ||
| "attackComplexity": "HIGH", | ||
| "privilegesRequired": "HIGH", | ||
| "userInteraction": "REQUIRED", | ||
| "scope": "UNCHANGED", | ||
| "confidentialityImpact": "LOW", | ||
| "integrityImpact": "NONE", | ||
| "availabilityImpact": "NONE", | ||
| "baseScore": 2.0, | ||
| "baseSeverity": "LOW" | ||
| }, | ||
| "exploitabilityScore": 0.5, | ||
| "impactScore": 1.4 | ||
| } | ||
| ] | ||
| }, | ||
| "weaknesses": [ | ||
| { | ||
| "source": "[email protected]", | ||
| "type": "Primary", | ||
| "description": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "CWE-172" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "url": "https://github.com/authzed/spicedb/commit/2f3cf77a7fcfcb478ef5a480a245842c96ac8853", | ||
| "source": "[email protected]" | ||
| }, | ||
| { | ||
| "url": "https://github.com/authzed/spicedb/security/advisories/GHSA-3c32-4hq9-6wgj", | ||
| "source": "[email protected]" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| { | ||
| "id": "CVE-2024-48911", | ||
| "sourceIdentifier": "[email protected]", | ||
| "published": "2024-10-14T21:15:12.323", | ||
| "lastModified": "2024-10-14T21:15:12.323", | ||
| "vulnStatus": "Received", | ||
| "cveTags": [], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored in an unprivileged user directory but the daemon is executed by root, it\u2019s possible for the unprivileged user to change the config file and escalate permissions when root later runs the daemon. Version 0.9.4 contains a fix for the issue." | ||
| } | ||
| ], | ||
| "metrics": { | ||
| "cvssMetricV40": [ | ||
| { | ||
| "source": "[email protected]", | ||
| "type": "Secondary", | ||
| "cvssData": { | ||
| "version": "4.0", | ||
| "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", | ||
| "attackVector": "LOCAL", | ||
| "attackComplexity": "LOW", | ||
| "attackRequirements": "PRESENT", | ||
| "privilegesRequired": "LOW", | ||
| "userInteraction": "NONE", | ||
| "vulnerableSystemConfidentiality": "LOW", | ||
| "vulnerableSystemIntegrity": "HIGH", | ||
| "vulnerableSystemAvailability": "LOW", | ||
| "subsequentSystemConfidentiality": "NONE", | ||
| "subsequentSystemIntegrity": "NONE", | ||
| "subsequentSystemAvailability": "NONE", | ||
| "exploitMaturity": "NOT_DEFINED", | ||
| "confidentialityRequirements": "NOT_DEFINED", | ||
| "integrityRequirements": "NOT_DEFINED", | ||
| "availabilityRequirements": "NOT_DEFINED", | ||
| "modifiedAttackVector": "NOT_DEFINED", | ||
| "modifiedAttackComplexity": "NOT_DEFINED", | ||
| "modifiedAttackRequirements": "NOT_DEFINED", | ||
| "modifiedPrivilegesRequired": "NOT_DEFINED", | ||
| "modifiedUserInteraction": "NOT_DEFINED", | ||
| "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", | ||
| "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", | ||
| "modifiedVulnerableSystemAvailability": "NOT_DEFINED", | ||
| "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", | ||
| "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", | ||
| "modifiedSubsequentSystemAvailability": "NOT_DEFINED", | ||
| "safety": "NOT_DEFINED", | ||
| "automatable": "NOT_DEFINED", | ||
| "recovery": "NOT_DEFINED", | ||
| "valueDensity": "NOT_DEFINED", | ||
| "vulnerabilityResponseEffort": "NOT_DEFINED", | ||
| "providerUrgency": "NOT_DEFINED", | ||
| "baseScore": 5.8, | ||
| "baseSeverity": "MEDIUM" | ||
| } | ||
| } | ||
| ] | ||
| }, | ||
| "weaknesses": [ | ||
| { | ||
| "source": "[email protected]", | ||
| "type": "Primary", | ||
| "description": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "CWE-863" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "url": "https://github.com/thinkst/opencanary/commit/2c11575b1a3dd8b0df26a879ba856c0aa350c049", | ||
| "source": "[email protected]" | ||
| }, | ||
| { | ||
| "url": "https://github.com/thinkst/opencanary/releases/tag/v0.9.4", | ||
| "source": "[email protected]" | ||
| }, | ||
| { | ||
| "url": "https://github.com/thinkst/opencanary/security/advisories/GHSA-pf5v-pqfv-x8jj", | ||
| "source": "[email protected]" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| { | ||
| "id": "CVE-2024-6207", | ||
| "sourceIdentifier": "[email protected]", | ||
| "published": "2024-10-14T21:15:12.460", | ||
| "lastModified": "2024-10-14T21:15:12.460", | ||
| "vulnStatus": "Received", | ||
| "cveTags": [], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html \u00a0and send a specially crafted CIP message to the device. If exploited, a threat actor could help prevent access to the legitimate user and end connections to connected devices including the workstation. To recover the controllers, a download is required which ends any process that the controller is running." | ||
| } | ||
| ], | ||
| "metrics": { | ||
| "cvssMetricV40": [ | ||
| { | ||
| "source": "[email protected]", | ||
| "type": "Secondary", | ||
| "cvssData": { | ||
| "version": "4.0", | ||
| "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", | ||
| "attackVector": "NETWORK", | ||
| "attackComplexity": "LOW", | ||
| "attackRequirements": "NONE", | ||
| "privilegesRequired": "NONE", | ||
| "userInteraction": "NONE", | ||
| "vulnerableSystemConfidentiality": "NONE", | ||
| "vulnerableSystemIntegrity": "NONE", | ||
| "vulnerableSystemAvailability": "HIGH", | ||
| "subsequentSystemConfidentiality": "NONE", | ||
| "subsequentSystemIntegrity": "NONE", | ||
| "subsequentSystemAvailability": "NONE", | ||
| "exploitMaturity": "NOT_DEFINED", | ||
| "confidentialityRequirements": "NOT_DEFINED", | ||
| "integrityRequirements": "NOT_DEFINED", | ||
| "availabilityRequirements": "NOT_DEFINED", | ||
| "modifiedAttackVector": "NOT_DEFINED", | ||
| "modifiedAttackComplexity": "NOT_DEFINED", | ||
| "modifiedAttackRequirements": "NOT_DEFINED", | ||
| "modifiedPrivilegesRequired": "NOT_DEFINED", | ||
| "modifiedUserInteraction": "NOT_DEFINED", | ||
| "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", | ||
| "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", | ||
| "modifiedVulnerableSystemAvailability": "NOT_DEFINED", | ||
| "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", | ||
| "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", | ||
| "modifiedSubsequentSystemAvailability": "NOT_DEFINED", | ||
| "safety": "NOT_DEFINED", | ||
| "automatable": "NOT_DEFINED", | ||
| "recovery": "NOT_DEFINED", | ||
| "valueDensity": "NOT_DEFINED", | ||
| "vulnerabilityResponseEffort": "NOT_DEFINED", | ||
| "providerUrgency": "NOT_DEFINED", | ||
| "baseScore": 8.7, | ||
| "baseSeverity": "HIGH" | ||
| } | ||
| } | ||
| ], | ||
| "cvssMetricV31": [ | ||
| { | ||
| "source": "[email protected]", | ||
| "type": "Secondary", | ||
| "cvssData": { | ||
| "version": "3.1", | ||
| "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", | ||
| "attackVector": "NETWORK", | ||
| "attackComplexity": "LOW", | ||
| "privilegesRequired": "NONE", | ||
| "userInteraction": "NONE", | ||
| "scope": "UNCHANGED", | ||
| "confidentialityImpact": "NONE", | ||
| "integrityImpact": "NONE", | ||
| "availabilityImpact": "HIGH", | ||
| "baseScore": 7.5, | ||
| "baseSeverity": "HIGH" | ||
| }, | ||
| "exploitabilityScore": 3.9, | ||
| "impactScore": 3.6 | ||
| } | ||
| ] | ||
| }, | ||
| "weaknesses": [ | ||
| { | ||
| "source": "[email protected]", | ||
| "type": "Secondary", | ||
| "description": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "CWE-20" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1707.html", | ||
| "source": "[email protected]" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.