generated content from 2024-03-10

mapping.csv

@@ -227745,3 +227745,26 @@ vulnerability,CVE-2023-47221,vulnerability--d4114eaa-0a87-4299-aa76-b3656a60b2ee
 vulnerability,CVE-2023-34980,vulnerability--cc8beb29-abf5-47ae-9cf3-c2a98e76e62a
 vulnerability,CVE-2019-6268,vulnerability--1f80f97a-bf6f-4388-ba49-8764e1557b24
 vulnerability,CVE-2022-43855,vulnerability--9c793ef0-bad6-4128-bdbc-76a4df74553e
+vulnerability,CVE-2024-2332,vulnerability--979de1ee-8f80-4323-a027-4dd4384ff462
+vulnerability,CVE-2024-2329,vulnerability--dbe86f39-4df8-45ef-b199-e8949061a97f
+vulnerability,CVE-2024-2331,vulnerability--ad6f5c81-aa2d-4490-943c-122ebc388df4
+vulnerability,CVE-2024-2330,vulnerability--bf84ea4f-28f6-4399-84db-927797f12270
+vulnerability,CVE-2024-2333,vulnerability--7c10a36f-4ed5-45fb-920a-478d6db321e0
+vulnerability,CVE-2024-28176,vulnerability--492c0fb3-fc11-4744-8024-af22328c1946
+vulnerability,CVE-2024-28180,vulnerability--013a3077-fef9-46d0-8019-f320ca82369b
+vulnerability,CVE-2024-28122,vulnerability--7fb618fc-9e1c-4db1-802f-7de82f9434d0
+vulnerability,CVE-2024-28089,vulnerability--22b250d6-f933-48b5-ad46-cd971d419d8a
+vulnerability,CVE-2024-28184,vulnerability--b57d1566-c74e-4c97-9abd-1e0e55cee7ba
+vulnerability,CVE-2024-1767,vulnerability--f3b9378c-c53e-4277-96ef-ac50c7778940
+vulnerability,CVE-2024-1125,vulnerability--1df25fc9-46de-4e47-a6b8-61cd0e0b79e4
+vulnerability,CVE-2024-1124,vulnerability--766933ad-aa71-4f82-8fe2-92e9c589ad92
+vulnerability,CVE-2024-1870,vulnerability--efe888f0-4fd2-469b-a91e-c5868770b995
+vulnerability,CVE-2024-1320,vulnerability--ac72a50d-2c2a-42b9-8d8d-29ea3a9f642b
+vulnerability,CVE-2024-1123,vulnerability--ad1b41ea-a882-4807-840e-bccab1d77420
+vulnerability,CVE-2024-25951,vulnerability--7bd863e9-b71c-4f84-bcc4-e3a4c07108a3
+vulnerability,CVE-2024-25501,vulnerability--9806070a-0776-4d23-8fbb-2e83187a10de
+vulnerability,CVE-2023-46427,vulnerability--ac1aaa1c-ff05-4efc-8095-46e87c92bebf
+vulnerability,CVE-2023-46426,vulnerability--8b4849d9-e1cc-4c77-bab7-839004544f7d
+vulnerability,CVE-2023-50015,vulnerability--78c76827-875b-44ce-bca3-0c58314a6f43
+vulnerability,CVE-2023-49341,vulnerability--634c6c97-ae69-4c25-855f-4aca15f1101e
+vulnerability,CVE-2023-49340,vulnerability--8c04c53f-c25a-4c82-95a1-a40182b455e3

objects/vulnerability/vulnerability--013a3077-fef9-46d0-8019-f320ca82369b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--7a77e06f-130d-4ebf-b71c-e7e056180c2c",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--013a3077-fef9-46d0-8019-f320ca82369b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:49.574002Z",
+            "modified": "2024-03-10T00:29:49.574002Z",
+            "name": "CVE-2024-28180",
+            "description": "Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.\n",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-28180"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--1df25fc9-46de-4e47-a6b8-61cd0e0b79e4.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--0fc9f01a-8ea6-40d8-9e4f-69a2faf77184",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--1df25fc9-46de-4e47-a6b8-61cd0e0b79e4",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:49.622851Z",
+            "modified": "2024-03-10T00:29:49.622851Z",
+            "name": "CVE-2024-1125",
+            "description": "The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the calendar_events_delete() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-1125"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--22b250d6-f933-48b5-ad46-cd971d419d8a.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--69521b26-63eb-4568-b8aa-ff33f7d96fff",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--22b250d6-f933-48b5-ad46-cd971d419d8a",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:49.591807Z",
+            "modified": "2024-03-10T00:29:49.591807Z",
+            "name": "CVE-2024-28089",
+            "description": "Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity (who has access to the router admin panel) to conduct a DOM-based stored XSS attack that can fetch remote resources. The payload is executed at index.html#advanced_location (aka the Device Location page). This can cause a denial of service or lead to information disclosure.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-28089"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--492c0fb3-fc11-4744-8024-af22328c1946.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--31437383-6f1c-4313-a404-cf165600790a",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--492c0fb3-fc11-4744-8024-af22328c1946",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:49.565453Z",
+            "modified": "2024-03-10T00:29:49.565453Z",
+            "name": "CVE-2024-28176",
+            "description": "jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has \n been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-28176"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--634c6c97-ae69-4c25-855f-4aca15f1101e.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--ad937fbe-e355-49dd-9b6b-08983e91ab68",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--634c6c97-ae69-4c25-855f-4aca15f1101e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:55.116377Z",
+            "modified": "2024-03-10T00:29:55.116377Z",
+            "name": "CVE-2023-49341",
+            "description": "An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to obtain sensitive information via cleartext credential storage in backup.htm component.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-49341"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--766933ad-aa71-4f82-8fe2-92e9c589ad92.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--ac86ae83-d728-4079-b5a4-4df9c2612629",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--766933ad-aa71-4f82-8fe2-92e9c589ad92",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:49.628276Z",
+            "modified": "2024-03-10T00:29:49.628276Z",
+            "name": "CVE-2024-1124",
+            "description": "The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the ep_send_attendees_email() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary emails with arbitrary content from the site.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-1124"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--78c76827-875b-44ce-bca3-0c58314a6f43.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--50e6e64d-0ffb-4270-9f04-ea68fd95d45c",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--78c76827-875b-44ce-bca3-0c58314a6f43",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:54.506955Z",
+            "modified": "2024-03-10T00:29:54.506955Z",
+            "name": "CVE-2023-50015",
+            "description": "An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using an end-user session-identity token.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-50015"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--7bd863e9-b71c-4f84-bcc4-e3a4c07108a3.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--bcb2138c-6b9c-41e1-bf83-77ca018add68",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--7bd863e9-b71c-4f84-bcc4-e3a4c07108a3",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:49.913133Z",
+            "modified": "2024-03-10T00:29:49.913133Z",
+            "name": "CVE-2024-25951",
+            "description": "A command injection vulnerability exists in local RACADM. A malicious authenticated user could gain control of the underlying operating system.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-25951"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--7c10a36f-4ed5-45fb-920a-478d6db321e0.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--abeb4370-cc4a-4a45-ae2a-c119426a11d7",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--7c10a36f-4ed5-45fb-920a-478d6db321e0",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:49.4981Z",
+            "modified": "2024-03-10T00:29:49.4981Z",
+            "name": "CVE-2024-2333",
+            "description": "A vulnerability classified as critical has been found in CodeAstro Membership Management System 1.0. Affected is an unknown function of the file /add_members.php. The manipulation of the argument fullname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256284.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-2333"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--7fb618fc-9e1c-4db1-802f-7de82f9434d0.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--2c99fc25-7f7f-40f9-8259-3af14cec8de8",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--7fb618fc-9e1c-4db1-802f-7de82f9434d0",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:49.582174Z",
+            "modified": "2024-03-10T00:29:49.582174Z",
+            "name": "CVE-2024-28122",
+            "description": " JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-28122"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--8b4849d9-e1cc-4c77-bab7-839004544f7d.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--f4c68246-fa27-4410-b3f4-35bac61c0175",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--8b4849d9-e1cc-4c77-bab7-839004544f7d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:53.803696Z",
+            "modified": "2024-03-10T00:29:53.803696Z",
+            "name": "CVE-2023-46426",
+            "description": "Heap-based Buffer Overflow vulnerability in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) via gf_fwrite component in at utils/os_file.c.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-46426"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--8c04c53f-c25a-4c82-95a1-a40182b455e3.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--08f5fc97-2f37-4458-9091-bb5a5be0ba94",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--8c04c53f-c25a-4c82-95a1-a40182b455e3",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:55.122702Z",
+            "modified": "2024-03-10T00:29:55.122702Z",
+            "name": "CVE-2023-49340",
+            "description": "An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileges and bypass authentication via incorrect access control in the web management portal.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-49340"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--979de1ee-8f80-4323-a027-4dd4384ff462.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--5bc2a3c5-2d88-402f-b263-ccaaf3ba1586",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--979de1ee-8f80-4323-a027-4dd4384ff462",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:49.478977Z",
+            "modified": "2024-03-10T00:29:49.478977Z",
+            "name": "CVE-2024-2332",
+            "description": "A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_category.php of the component HTTP GET Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256283.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-2332"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--9806070a-0776-4d23-8fbb-2e83187a10de.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--621173b1-3e79-4db5-9f0b-2e8933e722a5",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--9806070a-0776-4d23-8fbb-2e83187a10de",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:49.915602Z",
+            "modified": "2024-03-10T00:29:49.915602Z",
+            "name": "CVE-2024-25501",
+            "description": "An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-25501"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--ac1aaa1c-ff05-4efc-8095-46e87c92bebf.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--d9f2c8a7-0106-4764-aa5b-2b210b8ba093",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--ac1aaa1c-ff05-4efc-8095-46e87c92bebf",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-03-10T00:29:53.779115Z",
+            "modified": "2024-03-10T00:29:53.779115Z",
+            "name": "CVE-2023-46427",
+            "description": "An issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), and obtain sensitive information via null pointer deference in gf_dash_setup_period component in media_tools/dash_client.c.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-46427"
+                }
+            ]
+        }
+    ]
+}