From 35be1d9ef336481655917bf6e62d26cc29fc3869 Mon Sep 17 00:00:00 2001 From: cvelistV5 Github Action Date: Fri, 10 May 2024 20:33:41 +0000 Subject: [PATCH] 2 changes (2 new | 0 updated): - 2 new CVEs: CVE-2024-4736, CVE-2024-4737 - 0 updated CVEs: --- cves/2024/4xxx/CVE-2024-4736.json | 145 ++++++++++++++++++++++++++++++ cves/2024/4xxx/CVE-2024-4737.json | 145 ++++++++++++++++++++++++++++++ cves/delta.json | 18 ++-- cves/deltaLog.json | 47 +++++----- 4 files changed, 322 insertions(+), 33 deletions(-) create mode 100644 cves/2024/4xxx/CVE-2024-4736.json create mode 100644 cves/2024/4xxx/CVE-2024-4737.json diff --git a/cves/2024/4xxx/CVE-2024-4736.json b/cves/2024/4xxx/CVE-2024-4736.json new file mode 100644 index 000000000000..946098f4f05e --- /dev/null +++ b/cves/2024/4xxx/CVE-2024-4736.json @@ -0,0 +1,145 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.1", + "cveMetadata": { + "cveId": "CVE-2024-4736", + "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "state": "PUBLISHED", + "assignerShortName": "VulDB", + "dateReserved": "2024-05-10T08:33:40.351Z", + "datePublished": "2024-05-10T20:31:04.544Z", + "dateUpdated": "2024-05-10T20:31:04.544Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "shortName": "VulDB", + "dateUpdated": "2024-05-10T20:31:04.544Z" + }, + "title": "Campcodes Legal Case Management System tax cross site scripting", + "problemTypes": [ + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-79", + "lang": "en", + "description": "CWE-79 Cross Site Scripting" + } + ] + } + ], + "affected": [ + { + "vendor": "Campcodes", + "product": "Legal Case Management System", + "versions": [ + { + "version": "1.0", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability was found in Campcodes Legal Case Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/tax. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263822 is the identifier assigned to this vulnerability." + }, + { + "lang": "de", + "value": "Eine Schwachstelle wurde in Campcodes Legal Case Management System 1.0 gefunden. Sie wurde als problematisch eingestuft. Dies betrifft einen unbekannten Teil der Datei /admin/tax. Durch das Beeinflussen des Arguments name mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung." + } + ], + "metrics": [ + { + "cvssV4_0": { + "version": "4.0", + "baseScore": 5.3, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV3_1": { + "version": "3.1", + "baseScore": 3.5, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + } + }, + { + "cvssV3_0": { + "version": "3.0", + "baseScore": 3.5, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + } + }, + { + "cvssV2_0": { + "version": "2.0", + "baseScore": 4, + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N" + } + } + ], + "timeline": [ + { + "time": "2024-05-10T00:00:00.000Z", + "lang": "en", + "value": "Advisory disclosed" + }, + { + "time": "2024-05-10T02:00:00.000Z", + "lang": "en", + "value": "VulDB entry created" + }, + { + "time": "2024-05-10T10:38:56.000Z", + "lang": "en", + "value": "VulDB entry last update" + } + ], + "credits": [ + { + "lang": "en", + "value": "yylm (VulDB User)", + "type": "reporter" + } + ], + "references": [ + { + "url": "https://vuldb.com/?id.263822", + "name": "VDB-263822 | Campcodes Legal Case Management System tax cross site scripting", + "tags": [ + "vdb-entry", + "technical-description" + ] + }, + { + "url": "https://vuldb.com/?ctiid.263822", + "name": "VDB-263822 | CTI Indicators (IOB, IOC, TTP, IOA)", + "tags": [ + "signature", + "permissions-required" + ] + }, + { + "url": "https://vuldb.com/?submit.332409", + "name": "Submit #332409 | Campcodes Legal Case Management System 1.0 Cross Site Scripting", + "tags": [ + "third-party-advisory" + ] + }, + { + "url": "https://github.com/yylmm/CVE/blob/main/Legal%20Case%20Management%20System/xss_admin_tax.md", + "tags": [ + "exploit" + ] + } + ] + } + } +} \ No newline at end of file diff --git a/cves/2024/4xxx/CVE-2024-4737.json b/cves/2024/4xxx/CVE-2024-4737.json new file mode 100644 index 000000000000..1930c4481b23 --- /dev/null +++ b/cves/2024/4xxx/CVE-2024-4737.json @@ -0,0 +1,145 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.1", + "cveMetadata": { + "cveId": "CVE-2024-4737", + "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "state": "PUBLISHED", + "assignerShortName": "VulDB", + "dateReserved": "2024-05-10T08:33:43.635Z", + "datePublished": "2024-05-10T20:31:06.093Z", + "dateUpdated": "2024-05-10T20:31:06.093Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "shortName": "VulDB", + "dateUpdated": "2024-05-10T20:31:06.093Z" + }, + "title": "Campcodes Legal Case Management System vendor cross site scripting", + "problemTypes": [ + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-79", + "lang": "en", + "description": "CWE-79 Cross Site Scripting" + } + ] + } + ], + "affected": [ + { + "vendor": "Campcodes", + "product": "Legal Case Management System", + "versions": [ + { + "version": "1.0", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/vendor. The manipulation of the argument company_name/mobile leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263823." + }, + { + "lang": "de", + "value": "Es wurde eine Schwachstelle in Campcodes Legal Case Management System 1.0 ausgemacht. Sie wurde als problematisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Datei /admin/vendor. Durch Beeinflussen des Arguments company_name/mobile mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung." + } + ], + "metrics": [ + { + "cvssV4_0": { + "version": "4.0", + "baseScore": 5.3, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV3_1": { + "version": "3.1", + "baseScore": 3.5, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + } + }, + { + "cvssV3_0": { + "version": "3.0", + "baseScore": 3.5, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + } + }, + { + "cvssV2_0": { + "version": "2.0", + "baseScore": 4, + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N" + } + } + ], + "timeline": [ + { + "time": "2024-05-10T00:00:00.000Z", + "lang": "en", + "value": "Advisory disclosed" + }, + { + "time": "2024-05-10T02:00:00.000Z", + "lang": "en", + "value": "VulDB entry created" + }, + { + "time": "2024-05-10T10:38:58.000Z", + "lang": "en", + "value": "VulDB entry last update" + } + ], + "credits": [ + { + "lang": "en", + "value": "yylm (VulDB User)", + "type": "reporter" + } + ], + "references": [ + { + "url": "https://vuldb.com/?id.263823", + "name": "VDB-263823 | Campcodes Legal Case Management System vendor cross site scripting", + "tags": [ + "vdb-entry", + "technical-description" + ] + }, + { + "url": "https://vuldb.com/?ctiid.263823", + "name": "VDB-263823 | CTI Indicators (IOB, IOC, TTP, IOA)", + "tags": [ + "signature", + "permissions-required" + ] + }, + { + "url": "https://vuldb.com/?submit.332411", + "name": "Submit #332411 | Campcodes Legal Case Management System 1.0 Cross Site Scripting", + "tags": [ + "third-party-advisory" + ] + }, + { + "url": "https://github.com/yylmm/CVE/blob/main/Legal%20Case%20Management%20System/xss_admin_vendor.md", + "tags": [ + "exploit" + ] + } + ] + } + } +} \ No newline at end of file diff --git a/cves/delta.json b/cves/delta.json index 1475a1b1fd7b..ca4205926d48 100644 --- a/cves/delta.json +++ b/cves/delta.json @@ -1,12 +1,18 @@ { - "fetchTime": "2024-05-10T20:27:51.173Z", - "numberOfChanges": 1, + "fetchTime": "2024-05-10T20:33:37.333Z", + "numberOfChanges": 2, "new": [ { - "cveId": "CVE-2024-27460", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-27460", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/27xxx/CVE-2024-27460.json", - "dateUpdated": "2024-05-10T20:23:40.777Z" + "cveId": "CVE-2024-4736", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-4736", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4736.json", + "dateUpdated": "2024-05-10T20:31:04.544Z" + }, + { + "cveId": "CVE-2024-4737", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-4737", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4737.json", + "dateUpdated": "2024-05-10T20:31:06.093Z" } ], "updated": [], diff --git a/cves/deltaLog.json b/cves/deltaLog.json index 11bd1479f066..fc8941093093 100644 --- a/cves/deltaLog.json +++ b/cves/deltaLog.json @@ -1,4 +1,24 @@ [ + { + "fetchTime": "2024-05-10T20:33:37.333Z", + "numberOfChanges": 2, + "new": [ + { + "cveId": "CVE-2024-4736", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-4736", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4736.json", + "dateUpdated": "2024-05-10T20:31:04.544Z" + }, + { + "cveId": "CVE-2024-4737", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-4737", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4737.json", + "dateUpdated": "2024-05-10T20:31:06.093Z" + } + ], + "updated": [], + "error": [] + }, { "fetchTime": "2024-05-10T20:27:51.173Z", "numberOfChanges": 1, @@ -64168,32 +64188,5 @@ ], "updated": [], "error": [] - }, - { - "fetchTime": "2024-04-10T20:31:11.268Z", - "numberOfChanges": 3, - "new": [ - { - "cveId": "CVE-2024-26362", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-26362", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/26xxx/CVE-2024-26362.json", - "dateUpdated": "2024-04-10T20:25:37.182834" - }, - { - "cveId": "CVE-2024-31986", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-31986", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/31xxx/CVE-2024-31986.json", - "dateUpdated": "2024-04-10T20:27:29.600Z" - } - ], - "updated": [ - { - "cveId": "CVE-2024-31985", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-31985", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/31xxx/CVE-2024-31985.json", - "dateUpdated": "2024-04-10T20:25:56.501Z" - } - ], - "error": [] } ] \ No newline at end of file