From 47316cb78f20a41d6da08fcbc9f66b5923c88119 Mon Sep 17 00:00:00 2001 From: cad-safe-bot Date: Thu, 24 Oct 2024 22:03:20 +0000 Subject: [PATCH] Auto-Update: 2024-10-24T22:00:18.909139+00:00 --- CVE-2022/CVE-2022-489xx/CVE-2022-48958.json | 182 +++++++++++++- CVE-2022/CVE-2022-489xx/CVE-2022-48961.json | 122 +++++++++- CVE-2023/CVE-2023-299xx/CVE-2023-29929.json | 4 +- CVE-2023/CVE-2023-383xx/CVE-2023-38334.json | 14 +- CVE-2023/CVE-2023-383xx/CVE-2023-38335.json | 14 +- CVE-2023/CVE-2023-492xx/CVE-2023-49233.json | 4 +- CVE-2023/CVE-2023-508xx/CVE-2023-50809.json | 14 +- CVE-2024/CVE-2024-103xx/CVE-2024-10327.json | 60 +++++ CVE-2024/CVE-2024-216xx/CVE-2024-21687.json | 14 +- CVE-2024/CVE-2024-347xx/CVE-2024-34734.json | 4 +- CVE-2024/CVE-2024-361xx/CVE-2024-36130.json | 14 +- CVE-2024/CVE-2024-368xx/CVE-2024-36877.json | 14 +- CVE-2024/CVE-2024-405xx/CVE-2024-40531.json | 14 +- CVE-2024/CVE-2024-412xx/CVE-2024-41250.json | 12 +- CVE-2024/CVE-2024-412xx/CVE-2024-41251.json | 12 +- CVE-2024/CVE-2024-428xx/CVE-2024-42815.json | 4 +- CVE-2024/CVE-2024-429xx/CVE-2024-42966.json | 4 +- CVE-2024/CVE-2024-429xx/CVE-2024-42977.json | 4 +- CVE-2024/CVE-2024-429xx/CVE-2024-42986.json | 4 +- CVE-2024/CVE-2024-452xx/CVE-2024-45242.json | 25 ++ CVE-2024/CVE-2024-452xx/CVE-2024-45259.json | 21 ++ CVE-2024/CVE-2024-452xx/CVE-2024-45260.json | 21 ++ CVE-2024/CVE-2024-452xx/CVE-2024-45261.json | 21 ++ CVE-2024/CVE-2024-452xx/CVE-2024-45262.json | 21 ++ CVE-2024/CVE-2024-452xx/CVE-2024-45263.json | 21 ++ CVE-2024/CVE-2024-478xx/CVE-2024-47878.json | 60 +++++ CVE-2024/CVE-2024-478xx/CVE-2024-47879.json | 64 +++++ CVE-2024/CVE-2024-478xx/CVE-2024-47880.json | 64 +++++ CVE-2024/CVE-2024-478xx/CVE-2024-47881.json | 60 +++++ CVE-2024/CVE-2024-478xx/CVE-2024-47882.json | 68 ++++++ CVE-2024/CVE-2024-478xx/CVE-2024-47883.json | 64 +++++ CVE-2024/CVE-2024-482xx/CVE-2024-48208.json | 21 ++ CVE-2024/CVE-2024-484xx/CVE-2024-48423.json | 21 ++ CVE-2024/CVE-2024-484xx/CVE-2024-48424.json | 21 ++ CVE-2024/CVE-2024-484xx/CVE-2024-48425.json | 21 ++ CVE-2024/CVE-2024-484xx/CVE-2024-48426.json | 21 ++ CVE-2024/CVE-2024-484xx/CVE-2024-48454.json | 39 ++- CVE-2024/CVE-2024-485xx/CVE-2024-48538.json | 39 ++- CVE-2024/CVE-2024-485xx/CVE-2024-48539.json | 39 ++- CVE-2024/CVE-2024-485xx/CVE-2024-48544.json | 39 ++- CVE-2024/CVE-2024-485xx/CVE-2024-48548.json | 39 ++- CVE-2024/CVE-2024-489xx/CVE-2024-48931.json | 60 +++++ CVE-2024/CVE-2024-489xx/CVE-2024-48932.json | 60 +++++ CVE-2024/CVE-2024-498xx/CVE-2024-49869.json | 70 +++++- CVE-2024/CVE-2024-498xx/CVE-2024-49871.json | 123 +++++++++- CVE-2024/CVE-2024-498xx/CVE-2024-49873.json | 70 +++++- CVE-2024/CVE-2024-498xx/CVE-2024-49874.json | 94 ++++++- CVE-2024/CVE-2024-498xx/CVE-2024-49875.json | 129 +++++++++- CVE-2024/CVE-2024-503xx/CVE-2024-50382.json | 43 +++- CVE-2024/CVE-2024-503xx/CVE-2024-50383.json | 43 +++- CVE-2024/CVE-2024-75xx/CVE-2024-7535.json | 6 +- CVE-2024/CVE-2024-77xx/CVE-2024-7763.json | 60 +++++ CVE-2024/CVE-2024-79xx/CVE-2024-7973.json | 6 +- README.md | 109 ++++----- _state.csv | 257 +++++++++++--------- 55 files changed, 2103 insertions(+), 351 deletions(-) create mode 100644 CVE-2024/CVE-2024-103xx/CVE-2024-10327.json create mode 100644 CVE-2024/CVE-2024-452xx/CVE-2024-45242.json create mode 100644 CVE-2024/CVE-2024-452xx/CVE-2024-45259.json create mode 100644 CVE-2024/CVE-2024-452xx/CVE-2024-45260.json create mode 100644 CVE-2024/CVE-2024-452xx/CVE-2024-45261.json create mode 100644 CVE-2024/CVE-2024-452xx/CVE-2024-45262.json create mode 100644 CVE-2024/CVE-2024-452xx/CVE-2024-45263.json create mode 100644 CVE-2024/CVE-2024-478xx/CVE-2024-47878.json create mode 100644 CVE-2024/CVE-2024-478xx/CVE-2024-47879.json create mode 100644 CVE-2024/CVE-2024-478xx/CVE-2024-47880.json create mode 100644 CVE-2024/CVE-2024-478xx/CVE-2024-47881.json create mode 100644 CVE-2024/CVE-2024-478xx/CVE-2024-47882.json create mode 100644 CVE-2024/CVE-2024-478xx/CVE-2024-47883.json create mode 100644 CVE-2024/CVE-2024-482xx/CVE-2024-48208.json create mode 100644 CVE-2024/CVE-2024-484xx/CVE-2024-48423.json create mode 100644 CVE-2024/CVE-2024-484xx/CVE-2024-48424.json create mode 100644 CVE-2024/CVE-2024-484xx/CVE-2024-48425.json create mode 100644 CVE-2024/CVE-2024-484xx/CVE-2024-48426.json create mode 100644 CVE-2024/CVE-2024-489xx/CVE-2024-48931.json create mode 100644 CVE-2024/CVE-2024-489xx/CVE-2024-48932.json create mode 100644 CVE-2024/CVE-2024-77xx/CVE-2024-7763.json diff --git a/CVE-2022/CVE-2022-489xx/CVE-2022-48958.json b/CVE-2022/CVE-2022-489xx/CVE-2022-48958.json index 9278880ce8c..55c6b8fe5d9 100644 --- a/CVE-2022/CVE-2022-489xx/CVE-2022-48958.json +++ b/CVE-2022/CVE-2022-489xx/CVE-2022-48958.json @@ -2,8 +2,8 @@ "id": "CVE-2022-48958", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2024-10-21T20:15:07.270", - "lastModified": "2024-10-23T15:13:25.583", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2024-10-24T20:00:34.033", + "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { @@ -15,39 +15,199 @@ "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ethernet: aeroflex: se corrige una posible fuga de skb en greth_init_rings() La funci\u00f3n greth_init_rings() no liberar\u00e1 el skb reci\u00e9n asignado cuando dma_mapping_error() devuelva un error, por lo que se debe agregar dev_kfree_skb() para corregirlo. Solo se prob\u00f3 la compilaci\u00f3n." } ], - "metrics": {}, + "metrics": { + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "HIGH", + "baseScore": 5.5, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + } + ] + }, + "weaknesses": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-401" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", + "versionStartIncluding": "2.6.34", + "versionEndExcluding": "4.9.336", + "matchCriteriaId": "DE72942B-2F89-4BEA-A298-C2FA7DCC6DB5" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", + "versionStartIncluding": "4.10", + "versionEndExcluding": "4.14.302", + "matchCriteriaId": "FB3E1F82-01A3-456E-9C83-D567B9A75815" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", + "versionStartIncluding": "4.15", + "versionEndExcluding": "4.19.269", + "matchCriteriaId": "1185B8E3-712E-4BFB-BD01-78D47F7EF1F2" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", + "versionStartIncluding": "4.20", + "versionEndExcluding": "5.4.227", + "matchCriteriaId": "8C752145-904B-474A-A7F2-E9F29353B0FE" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", + "versionStartIncluding": "5.5", + "versionEndExcluding": "5.10.159", + "matchCriteriaId": "7318B597-DFFD-4BBC-A947-539D6E30D82A" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", + "versionStartIncluding": "5.11", + "versionEndExcluding": "5.15.83", + "matchCriteriaId": "90897BD1-104D-4CFF-94F5-29F9041217FB" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", + "versionStartIncluding": "5.16", + "versionEndExcluding": "6.0.13", + "matchCriteriaId": "389392A7-81C4-4C26-884B-8C7CF0F53DA4" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*", + "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*", + "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*", + "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*", + "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*", + "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*", + "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*", + "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*", + "matchCriteriaId": "21718AA4-4056-40F2-968E-BDAA465A7872" + } + ] + } + ] + } + ], "references": [ { "url": "https://git.kernel.org/stable/c/063a932b64db3317ec020c94466fe52923a15f60", - "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67" + "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", + "tags": [ + "Patch" + ] }, { "url": "https://git.kernel.org/stable/c/223654e2e2c8d05347cd8e300f8d1ec6023103dd", - "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67" + "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", + "tags": [ + "Patch" + ] }, { "url": "https://git.kernel.org/stable/c/87277bdf2c370ab2d07cfe77dfa9b37f82bbe1e5", - "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67" + "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", + "tags": [ + "Patch" + ] }, { "url": "https://git.kernel.org/stable/c/99669d94ce145389f1d6f197e6e18ed50d43fb76", - "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67" + "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", + "tags": [ + "Patch" + ] }, { "url": "https://git.kernel.org/stable/c/bfaa8f6c5b84b295dd73b0138b57c5555ca12b1c", - "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67" + "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", + "tags": [ + "Patch" + ] }, { "url": "https://git.kernel.org/stable/c/c7adcbd0fd3fde1b19150c3e955fb4a30c5bd9b7", - "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67" + "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", + "tags": [ + "Patch" + ] }, { "url": "https://git.kernel.org/stable/c/cb1e293f858e5e1152b8791047ed4bdaaf392189", - "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67" + "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", + "tags": [ + "Patch" + ] }, { "url": "https://git.kernel.org/stable/c/dd62867a6383f78f75f07039394aac25924a3307", - "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67" + "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", + "tags": [ + "Patch" + ] } ] } \ No newline at end of file diff --git a/CVE-2022/CVE-2022-489xx/CVE-2022-48961.json b/CVE-2022/CVE-2022-489xx/CVE-2022-48961.json index 418751c00c8..b39a91019d7 100644 --- a/CVE-2022/CVE-2022-489xx/CVE-2022-48961.json +++ b/CVE-2022/CVE-2022-489xx/CVE-2022-48961.json @@ -2,8 +2,8 @@ "id": "CVE-2022-48961", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2024-10-21T20:15:07.887", - "lastModified": "2024-10-23T15:13:25.583", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2024-10-24T20:02:22.347", + "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { @@ -15,19 +15,129 @@ "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: mdio: arregla el recuento de referencias de fwnode no balanceado en mdio_device_release() Hay un informe de advertencia sobre una fuga de recuento de referencias de of_node mientras se sondea el dispositivo mdio: OF: ERROR: fuga de memoria, se esperaba un recuento de referencias de 1 en lugar de 2, of_node_get()/of_node_put() no balanceado - destruye la entrada de cset: adjunta el nodo superpuesto /spi/soc@0/mdio@710700c0/ethernet@4 En of_mdiobus_register_device(), aumentamos el recuento de referencias de fwnode mediante fwnode_handle_get() antes de asociar el of_node con el dispositivo mdio, pero nunca se ha reducido en la ruta normal. Desde entonces, en mdio_device_release(), necesita llamar a fwnode_handle_put() adem\u00e1s en lugar de llamar a kfree() directamente. Despu\u00e9s de lo anterior, simplemente llamar a mdio_device_free() en la ruta del controlador de errores de of_mdiobus_register_device() es suficiente para mantener el recuento de referencias equilibrado." } ], - "metrics": {}, + "metrics": { + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "HIGH", + "baseScore": 5.5, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 1.8, + "impactScore": 3.6 + } + ] + }, + "weaknesses": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "NVD-CWE-Other" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", + "versionStartIncluding": "4.5", + "versionEndExcluding": "5.15.83", + "matchCriteriaId": "73BF1A37-67E4-474D-84C2-1BDDFC244D25" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", + "versionStartIncluding": "5.16", + "versionEndExcluding": "6.0.13", + "matchCriteriaId": "389392A7-81C4-4C26-884B-8C7CF0F53DA4" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*", + "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*", + "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*", + "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*", + "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*", + "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*", + "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*", + "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*", + "matchCriteriaId": "21718AA4-4056-40F2-968E-BDAA465A7872" + } + ] + } + ] + } + ], "references": [ { "url": "https://git.kernel.org/stable/c/16854177745a5648f8ec322353b432e18460f43a", - "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67" + "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", + "tags": [ + "Patch" + ] }, { "url": "https://git.kernel.org/stable/c/a5c6de1a6656b8cc6bce7cb3d9874dd7df4968c3", - "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67" + "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", + "tags": [ + "Patch" + ] }, { "url": "https://git.kernel.org/stable/c/cb37617687f2bfa5b675df7779f869147c9002bd", - "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67" + "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", + "tags": [ + "Patch" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-299xx/CVE-2023-29929.json b/CVE-2023/CVE-2023-299xx/CVE-2023-29929.json index a4a318334aa..764cc7a2c6d 100644 --- a/CVE-2023/CVE-2023-299xx/CVE-2023-29929.json +++ b/CVE-2023/CVE-2023-299xx/CVE-2023-29929.json @@ -2,7 +2,7 @@ "id": "CVE-2023-29929", "sourceIdentifier": "cve@mitre.org", "published": "2024-08-21T18:15:09.173", - "lastModified": "2024-08-22T21:15:15.840", + "lastModified": "2024-10-24T20:35:02.040", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [ @@ -46,7 +46,7 @@ "description": [ { "lang": "en", - "value": "CWE-121" + "value": "CWE-787" } ] } diff --git a/CVE-2023/CVE-2023-383xx/CVE-2023-38334.json b/CVE-2023/CVE-2023-383xx/CVE-2023-38334.json index f21d23ce16d..bf00ea14b15 100644 --- a/CVE-2023/CVE-2023-383xx/CVE-2023-38334.json +++ b/CVE-2023/CVE-2023-383xx/CVE-2023-38334.json @@ -2,8 +2,8 @@ "id": "CVE-2023-38334", "sourceIdentifier": "cve@mitre.org", "published": "2023-07-20T18:15:12.170", - "lastModified": "2023-07-31T18:42:53.743", - "vulnStatus": "Analyzed", + "lastModified": "2024-10-24T21:35:02.113", + "vulnStatus": "Modified", "cveTags": [], "descriptions": [ { @@ -45,6 +45,16 @@ "value": "NVD-CWE-Other" } ] + }, + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-276" + } + ] } ], "configurations": [ diff --git a/CVE-2023/CVE-2023-383xx/CVE-2023-38335.json b/CVE-2023/CVE-2023-383xx/CVE-2023-38335.json index 6d475b05c78..af1ab22bfa9 100644 --- a/CVE-2023/CVE-2023-383xx/CVE-2023-38335.json +++ b/CVE-2023/CVE-2023-383xx/CVE-2023-38335.json @@ -2,8 +2,8 @@ "id": "CVE-2023-38335", "sourceIdentifier": "cve@mitre.org", "published": "2023-07-20T18:15:12.227", - "lastModified": "2023-07-31T18:42:46.760", - "vulnStatus": "Analyzed", + "lastModified": "2024-10-24T21:35:04.503", + "vulnStatus": "Modified", "cveTags": [], "descriptions": [ { @@ -45,6 +45,16 @@ "value": "NVD-CWE-Other" } ] + }, + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-276" + } + ] } ], "configurations": [ diff --git a/CVE-2023/CVE-2023-492xx/CVE-2023-49233.json b/CVE-2023/CVE-2023-492xx/CVE-2023-49233.json index 8cbc967cfc1..d4822b2a21b 100644 --- a/CVE-2023/CVE-2023-492xx/CVE-2023-49233.json +++ b/CVE-2023/CVE-2023-492xx/CVE-2023-49233.json @@ -2,7 +2,7 @@ "id": "CVE-2023-49233", "sourceIdentifier": "cve@mitre.org", "published": "2024-09-03T17:15:14.400", - "lastModified": "2024-09-03T21:35:04.420", + "lastModified": "2024-10-24T20:35:03.457", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [ @@ -46,7 +46,7 @@ "description": [ { "lang": "en", - "value": "CWE-284" + "value": "CWE-522" } ] } diff --git a/CVE-2023/CVE-2023-508xx/CVE-2023-50809.json b/CVE-2023/CVE-2023-508xx/CVE-2023-50809.json index 638785d7001..d58c0a9f6ab 100644 --- a/CVE-2023/CVE-2023-508xx/CVE-2023-50809.json +++ b/CVE-2023/CVE-2023-508xx/CVE-2023-50809.json @@ -2,7 +2,7 @@ "id": "CVE-2023-50809", "sourceIdentifier": "cve@mitre.org", "published": "2024-08-12T13:38:11.923", - "lastModified": "2024-08-13T14:35:00.967", + "lastModified": "2024-10-24T20:35:04.223", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [ @@ -39,18 +39,6 @@ } ] }, - "weaknesses": [ - { - "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", - "type": "Secondary", - "description": [ - { - "lang": "en", - "value": "CWE-121" - } - ] - } - ], "references": [ { "url": "https://www.sonos.com/en-us/security-advisory-2024-0001", diff --git a/CVE-2024/CVE-2024-103xx/CVE-2024-10327.json b/CVE-2024/CVE-2024-103xx/CVE-2024-10327.json new file mode 100644 index 00000000000..1e9fe73e780 --- /dev/null +++ b/CVE-2024/CVE-2024-103xx/CVE-2024-10327.json @@ -0,0 +1,60 @@ +{ + "id": "CVE-2024-10327", + "sourceIdentifier": "psirt@okta.com", + "published": "2024-10-24T21:15:11.730", + "lastModified": "2024-10-24T21:15:11.730", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user\u2019s selection. When a user long-presses the notification banner and selects an option, both options allow the authentication to succeed. \nThe ContextExtension feature is one of several push mechanisms available when using Okta Verify Push on iOS devices. The vulnerable flows include: \n* When a user is presented with a notification on a locked screen, the user presses on the notification directly and selects their reply without unlocking the device; \n* When a user is presented with a notification on the home screen and drags the notification down and selects their reply; \n* When an Apple Watch is used to reply directly to a notification. \n\n A pre-condition for this vulnerability is that the user must have enrolled in Okta Verify while the Okta customer was using Okta Classic. This applies irrespective of whether the organization has since upgraded to Okta Identity Engine." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "psirt@okta.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE", + "baseScore": 8.1, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 2.8, + "impactScore": 5.2 + } + ] + }, + "weaknesses": [ + { + "source": "psirt@okta.com", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-287" + } + ] + } + ], + "references": [ + { + "url": "https://help.okta.com/en-us/content/topics/releasenotes/okta-verify-release-notes.htm#panel2", + "source": "psirt@okta.com" + }, + { + "url": "https://trust.okta.com/security-advisories/okta-verify-for-ios-cve-2024-10327/", + "source": "psirt@okta.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-216xx/CVE-2024-21687.json b/CVE-2024/CVE-2024-216xx/CVE-2024-21687.json index 8a3acb20469..600ae4e0188 100644 --- a/CVE-2024/CVE-2024-216xx/CVE-2024-21687.json +++ b/CVE-2024/CVE-2024-216xx/CVE-2024-21687.json @@ -2,7 +2,7 @@ "id": "CVE-2024-21687", "sourceIdentifier": "security@atlassian.com", "published": "2024-07-16T21:15:10.257", - "lastModified": "2024-08-01T13:46:48.050", + "lastModified": "2024-10-24T20:35:05.307", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [ @@ -39,18 +39,6 @@ } ] }, - "weaknesses": [ - { - "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", - "type": "Secondary", - "description": [ - { - "lang": "en", - "value": "CWE-98" - } - ] - } - ], "references": [ { "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1417150917", diff --git a/CVE-2024/CVE-2024-347xx/CVE-2024-34734.json b/CVE-2024/CVE-2024-347xx/CVE-2024-34734.json index 4e060c60698..5671b8abeed 100644 --- a/CVE-2024/CVE-2024-347xx/CVE-2024-34734.json +++ b/CVE-2024/CVE-2024-347xx/CVE-2024-34734.json @@ -2,7 +2,7 @@ "id": "CVE-2024-34734", "sourceIdentifier": "security@android.com", "published": "2024-08-15T22:15:06.337", - "lastModified": "2024-08-19T13:00:23.117", + "lastModified": "2024-10-24T20:35:05.433", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [ @@ -46,7 +46,7 @@ "description": [ { "lang": "en", - "value": "CWE-453" + "value": "CWE-1188" } ] } diff --git a/CVE-2024/CVE-2024-361xx/CVE-2024-36130.json b/CVE-2024/CVE-2024-361xx/CVE-2024-36130.json index 5e32f18ca05..93d1d15c176 100644 --- a/CVE-2024/CVE-2024-361xx/CVE-2024-36130.json +++ b/CVE-2024/CVE-2024-361xx/CVE-2024-36130.json @@ -2,8 +2,8 @@ "id": "CVE-2024-36130", "sourceIdentifier": "support@hackerone.com", "published": "2024-08-07T04:17:17.967", - "lastModified": "2024-08-12T18:52:50.947", - "vulnStatus": "Analyzed", + "lastModified": "2024-10-24T20:35:06.217", + "vulnStatus": "Modified", "cveTags": [], "descriptions": [ { @@ -71,16 +71,6 @@ "value": "CWE-287" } ] - }, - { - "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", - "type": "Secondary", - "description": [ - { - "lang": "en", - "value": "CWE-285" - } - ] } ], "configurations": [ diff --git a/CVE-2024/CVE-2024-368xx/CVE-2024-36877.json b/CVE-2024/CVE-2024-368xx/CVE-2024-36877.json index 9ddd9bf7647..e5032fd05ae 100644 --- a/CVE-2024/CVE-2024-368xx/CVE-2024-36877.json +++ b/CVE-2024/CVE-2024-368xx/CVE-2024-36877.json @@ -2,7 +2,7 @@ "id": "CVE-2024-36877", "sourceIdentifier": "cve@mitre.org", "published": "2024-08-12T16:15:15.300", - "lastModified": "2024-08-15T16:15:19.160", + "lastModified": "2024-10-24T20:35:06.353", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [ @@ -39,18 +39,6 @@ } ] }, - "weaknesses": [ - { - "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", - "type": "Secondary", - "description": [ - { - "lang": "en", - "value": "CWE-123" - } - ] - } - ], "references": [ { "url": "https://csr.msi.com/global/product-security-advisories", diff --git a/CVE-2024/CVE-2024-405xx/CVE-2024-40531.json b/CVE-2024/CVE-2024-405xx/CVE-2024-40531.json index 5a594a68fc2..eb4dd921666 100644 --- a/CVE-2024/CVE-2024-405xx/CVE-2024-40531.json +++ b/CVE-2024/CVE-2024-405xx/CVE-2024-40531.json @@ -2,7 +2,7 @@ "id": "CVE-2024-40531", "sourceIdentifier": "cve@mitre.org", "published": "2024-08-05T16:15:36.800", - "lastModified": "2024-08-28T19:15:08.797", + "lastModified": "2024-10-24T20:35:06.753", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [ @@ -39,18 +39,6 @@ } ] }, - "weaknesses": [ - { - "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", - "type": "Secondary", - "description": [ - { - "lang": "en", - "value": "CWE-284" - } - ] - } - ], "references": [ { "url": "https://critical.lt/blog/authorization-bypass-and-mass-assignment-in-pantera-crm/", diff --git a/CVE-2024/CVE-2024-412xx/CVE-2024-41250.json b/CVE-2024/CVE-2024-412xx/CVE-2024-41250.json index 8869ccf7436..70263cea157 100644 --- a/CVE-2024/CVE-2024-412xx/CVE-2024-41250.json +++ b/CVE-2024/CVE-2024-412xx/CVE-2024-41250.json @@ -2,7 +2,7 @@ "id": "CVE-2024-41250", "sourceIdentifier": "cve@mitre.org", "published": "2024-08-07T17:15:51.837", - "lastModified": "2024-08-08T21:35:16.680", + "lastModified": "2024-10-24T20:35:06.947", "vulnStatus": "Modified", "cveTags": [], "descriptions": [ @@ -69,16 +69,6 @@ "value": "NVD-CWE-Other" } ] - }, - { - "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", - "type": "Secondary", - "description": [ - { - "lang": "en", - "value": "CWE-284" - } - ] } ], "configurations": [ diff --git a/CVE-2024/CVE-2024-412xx/CVE-2024-41251.json b/CVE-2024/CVE-2024-412xx/CVE-2024-41251.json index f19144508c5..0e900deebb0 100644 --- a/CVE-2024/CVE-2024-412xx/CVE-2024-41251.json +++ b/CVE-2024/CVE-2024-412xx/CVE-2024-41251.json @@ -2,7 +2,7 @@ "id": "CVE-2024-41251", "sourceIdentifier": "cve@mitre.org", "published": "2024-08-07T16:15:45.850", - "lastModified": "2024-08-08T20:35:09.980", + "lastModified": "2024-10-24T20:35:07.133", "vulnStatus": "Modified", "cveTags": [], "descriptions": [ @@ -69,16 +69,6 @@ "value": "NVD-CWE-Other" } ] - }, - { - "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", - "type": "Secondary", - "description": [ - { - "lang": "en", - "value": "CWE-284" - } - ] } ], "configurations": [ diff --git a/CVE-2024/CVE-2024-428xx/CVE-2024-42815.json b/CVE-2024/CVE-2024-428xx/CVE-2024-42815.json index 91ad3dc2bda..f2ed521459d 100644 --- a/CVE-2024/CVE-2024-428xx/CVE-2024-42815.json +++ b/CVE-2024/CVE-2024-428xx/CVE-2024-42815.json @@ -2,7 +2,7 @@ "id": "CVE-2024-42815", "sourceIdentifier": "cve@mitre.org", "published": "2024-08-19T20:15:07.193", - "lastModified": "2024-09-03T21:15:16.197", + "lastModified": "2024-10-24T20:35:07.330", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [ @@ -46,7 +46,7 @@ "description": [ { "lang": "en", - "value": "CWE-121" + "value": "CWE-787" } ] } diff --git a/CVE-2024/CVE-2024-429xx/CVE-2024-42966.json b/CVE-2024/CVE-2024-429xx/CVE-2024-42966.json index 800705e8f30..7739503f03d 100644 --- a/CVE-2024/CVE-2024-429xx/CVE-2024-42966.json +++ b/CVE-2024/CVE-2024-429xx/CVE-2024-42966.json @@ -2,7 +2,7 @@ "id": "CVE-2024-42966", "sourceIdentifier": "cve@mitre.org", "published": "2024-08-15T17:15:20.130", - "lastModified": "2024-08-19T19:35:09.913", + "lastModified": "2024-10-24T20:35:08.087", "vulnStatus": "Modified", "cveTags": [], "descriptions": [ @@ -76,7 +76,7 @@ "description": [ { "lang": "en", - "value": "CWE-284" + "value": "CWE-863" } ] } diff --git a/CVE-2024/CVE-2024-429xx/CVE-2024-42977.json b/CVE-2024/CVE-2024-429xx/CVE-2024-42977.json index 2da705cdb5c..2d5590f6cdb 100644 --- a/CVE-2024/CVE-2024-429xx/CVE-2024-42977.json +++ b/CVE-2024/CVE-2024-429xx/CVE-2024-42977.json @@ -2,7 +2,7 @@ "id": "CVE-2024-42977", "sourceIdentifier": "cve@mitre.org", "published": "2024-08-15T17:15:20.860", - "lastModified": "2024-08-19T20:35:17.330", + "lastModified": "2024-10-24T20:35:08.860", "vulnStatus": "Modified", "cveTags": [], "descriptions": [ @@ -76,7 +76,7 @@ "description": [ { "lang": "en", - "value": "CWE-121" + "value": "CWE-787" } ] } diff --git a/CVE-2024/CVE-2024-429xx/CVE-2024-42986.json b/CVE-2024/CVE-2024-429xx/CVE-2024-42986.json index 958d96316ab..2bef0aa4063 100644 --- a/CVE-2024/CVE-2024-429xx/CVE-2024-42986.json +++ b/CVE-2024/CVE-2024-429xx/CVE-2024-42986.json @@ -2,7 +2,7 @@ "id": "CVE-2024-42986", "sourceIdentifier": "cve@mitre.org", "published": "2024-08-15T17:15:21.717", - "lastModified": "2024-08-19T21:35:07.937", + "lastModified": "2024-10-24T20:35:09.653", "vulnStatus": "Modified", "cveTags": [], "descriptions": [ @@ -76,7 +76,7 @@ "description": [ { "lang": "en", - "value": "CWE-121" + "value": "CWE-787" } ] } diff --git a/CVE-2024/CVE-2024-452xx/CVE-2024-45242.json b/CVE-2024/CVE-2024-452xx/CVE-2024-45242.json new file mode 100644 index 00000000000..a565b8308cc --- /dev/null +++ b/CVE-2024/CVE-2024-452xx/CVE-2024-45242.json @@ -0,0 +1,25 @@ +{ + "id": "CVE-2024-45242", + "sourceIdentifier": "cve@mitre.org", + "published": "2024-10-24T20:15:04.243", + "lastModified": "2024-10-24T20:15:04.243", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping or Speed Test utility. During the time of initial setup, the device creates an open unsecured network whose admin panel is configured with the default credentials of admin/admin. An unauthorized attacker in proximity to the Wi-Fi network can exploit this window of time to execute arbitrary OS commands with root-level permissions." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/actuator/cve/blob/main/Engenius/CVE-2024-45242", + "source": "cve@mitre.org" + }, + { + "url": "https://github.com/actuator/cve/blob/main/Engenius/CVE-2024-45242_Extended_Report.pdf", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-452xx/CVE-2024-45259.json b/CVE-2024/CVE-2024-452xx/CVE-2024-45259.json new file mode 100644 index 00000000000..f645d8aa48e --- /dev/null +++ b/CVE-2024/CVE-2024-452xx/CVE-2024-45259.json @@ -0,0 +1,21 @@ +{ + "id": "CVE-2024-45259", + "sourceIdentifier": "cve@mitre.org", + "published": "2024-10-24T20:15:04.323", + "lastModified": "2024-10-24T20:15:04.323", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Delete%20Any%20File%20via%20Download%20Interface.md", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-452xx/CVE-2024-45260.json b/CVE-2024/CVE-2024-452xx/CVE-2024-45260.json new file mode 100644 index 00000000000..6a200a4fa62 --- /dev/null +++ b/CVE-2024/CVE-2024-452xx/CVE-2024-45260.json @@ -0,0 +1,21 @@ +{ + "id": "CVE-2024-45260", + "sourceIdentifier": "cve@mitre.org", + "published": "2024-10-24T21:15:11.977", + "lastModified": "2024-10-24T21:15:11.977", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users who belong to unauthorized groups can invoke any interface of the device, thereby gaining complete control over it." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Unauthorized%20Access%20to%20File%20Download%20and%20Upload%20Interfaces.md", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-452xx/CVE-2024-45261.json b/CVE-2024/CVE-2024-452xx/CVE-2024-45261.json new file mode 100644 index 00000000000..0f8ff9f13b0 --- /dev/null +++ b/CVE-2024/CVE-2024-452xx/CVE-2024-45261.json @@ -0,0 +1,21 @@ +{ + "id": "CVE-2024-45261", + "sourceIdentifier": "cve@mitre.org", + "published": "2024-10-24T21:15:12.057", + "lastModified": "2024-10-24T21:15:12.057", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SID generated for a specific user is not tied to that user itself, which allows other users to potentially use it for authentication. Once an attacker bypasses the application's authentication procedures, they can generate a valid SID, escalate privileges, and gain full control." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypassing%20Login%20Mechanism%20with%20Passwordless%20User%20Login.md", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-452xx/CVE-2024-45262.json b/CVE-2024/CVE-2024-452xx/CVE-2024-45262.json new file mode 100644 index 00000000000..aa4a4a74061 --- /dev/null +++ b/CVE-2024/CVE-2024-452xx/CVE-2024-45262.json @@ -0,0 +1,21 @@ +{ + "id": "CVE-2024-45262", + "sourceIdentifier": "cve@mitre.org", + "published": "2024-10-24T21:15:12.143", + "lastModified": "2024-10-24T21:15:12.143", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The params parameter in the call method of the /rpc endpoint is vulnerable to arbitrary directory traversal, which enables attackers to execute scripts under any path." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Improper%20Pathname%20Restriction%20Leading%20to%20Path%20Traversal%20in%20Restricted%20Directories.md", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-452xx/CVE-2024-45263.json b/CVE-2024/CVE-2024-452xx/CVE-2024-45263.json new file mode 100644 index 00000000000..e3e2404296c --- /dev/null +++ b/CVE-2024/CVE-2024-452xx/CVE-2024-45263.json @@ -0,0 +1,21 @@ +{ + "id": "CVE-2024-45263", + "sourceIdentifier": "cve@mitre.org", + "published": "2024-10-24T21:15:12.217", + "lastModified": "2024-10-24T21:15:12.217", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Arbitrary%20File%20Upload%20to%20ovpn_upload%20via%20Upload%20Interface.md", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-478xx/CVE-2024-47878.json b/CVE-2024/CVE-2024-478xx/CVE-2024-47878.json new file mode 100644 index 00000000000..b6d7b3adc09 --- /dev/null +++ b/CVE-2024/CVE-2024-478xx/CVE-2024-47878.json @@ -0,0 +1,60 @@ +{ + "id": "CVE-2024-47878", + "sourceIdentifier": "security-advisories@github.com", + "published": "2024-10-24T21:15:12.293", + "lastModified": "2024-10-24T21:15:12.293", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET parameter verbatim in a `