generated content from 2023-12-04

mapping.csv

@@ -218924,3 +218924,12 @@ vulnerability,CVE-2023-6464,vulnerability--c5a558d5-737c-4545-9ca4-ac03a58947b7
 vulnerability,CVE-2023-6474,vulnerability--1d8809ac-5147-4c2f-b934-e93b19c16147
 vulnerability,CVE-2023-6472,vulnerability--a049b4b6-f112-4ec1-8d50-fa1f3a1de5f3
 vulnerability,CVE-2023-6473,vulnerability--4befa757-ed6b-4987-80f6-4d72b9ac2b2b
+vulnerability,CVE-2020-36768,vulnerability--e9c5d484-dde2-4f18-ae73-9025dc0e785d
+vulnerability,CVE-2018-25094,vulnerability--b35bcef5-045e-4c42-a09c-b90d720f7429
+vulnerability,CVE-2022-4957,vulnerability--ada2791f-1181-42d0-a7d4-eb4d8bdc39bb
+vulnerability,CVE-2023-40692,vulnerability--b4328fb2-20b6-4faa-8392-cc3667798332
+vulnerability,CVE-2023-49947,vulnerability--ae20c698-d025-4010-a52a-bb97c7204dbb
+vulnerability,CVE-2023-49926,vulnerability--3ee4a0dd-5275-479f-8e6f-3086680f4b2d
+vulnerability,CVE-2023-49946,vulnerability--a44e7a57-27f0-407f-9701-897320b56609
+vulnerability,CVE-2023-49948,vulnerability--443ad709-94b2-412d-a9e0-7012e2d3db24
+vulnerability,CVE-2023-45178,vulnerability--5d69baf4-4bde-40e1-ba4b-198a72a1c448

objects/vulnerability/vulnerability--3ee4a0dd-5275-479f-8e6f-3086680f4b2d.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--d393323b-55d5-4a84-af27-270a5ecb773d",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--3ee4a0dd-5275-479f-8e6f-3086680f4b2d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2023-12-04T00:17:18.254163Z",
+            "modified": "2023-12-04T00:17:18.254163Z",
+            "name": "CVE-2023-49926",
+            "description": "app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-49926"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--443ad709-94b2-412d-a9e0-7012e2d3db24.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--e79df3b7-938e-4ad6-b7d9-1af2ccbd9b9e",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--443ad709-94b2-412d-a9e0-7012e2d3db24",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2023-12-04T00:17:18.282132Z",
+            "modified": "2023-12-04T00:17:18.282132Z",
+            "name": "CVE-2023-49948",
+            "description": "Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-49948"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--5d69baf4-4bde-40e1-ba4b-198a72a1c448.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--2c74517d-64e2-4df8-bf37-d47ea1724532",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--5d69baf4-4bde-40e1-ba4b-198a72a1c448",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2023-12-04T00:17:18.766673Z",
+            "modified": "2023-12-04T00:17:18.766673Z",
+            "name": "CVE-2023-45178",
+            "description": "IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 CLI is vulnerable to a denial of service when a specially crafted request is used.  IBM X-Force ID:  268073.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-45178"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--a44e7a57-27f0-407f-9701-897320b56609.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--60aff1a1-78d5-4c25-849d-6682a0b6d84d",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--a44e7a57-27f0-407f-9701-897320b56609",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2023-12-04T00:17:18.260367Z",
+            "modified": "2023-12-04T00:17:18.260367Z",
+            "name": "CVE-2023-49946",
+            "description": "In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-49946"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--ada2791f-1181-42d0-a7d4-eb4d8bdc39bb.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--49ee744a-3318-4972-a7da-b6c5435c6c01",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--ada2791f-1181-42d0-a7d4-eb4d8bdc39bb",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2023-12-04T00:17:16.014851Z",
+            "modified": "2023-12-04T00:17:16.014851Z",
+            "name": "CVE-2022-4957",
+            "description": "A vulnerability was found in librespeed speedtest up to 5.2.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file results/stats.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. Upgrading to version 5.2.5 is able to address this issue. The patch is named a85f2c086f3449dffa8fe2edb5e2ef3ee72dc0e9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-246643.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2022-4957"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--ae20c698-d025-4010-a52a-bb97c7204dbb.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--86e7ab32-fe09-4240-a948-6f1d81417a6c",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--ae20c698-d025-4010-a52a-bb97c7204dbb",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2023-12-04T00:17:18.247308Z",
+            "modified": "2023-12-04T00:17:18.247308Z",
+            "name": "CVE-2023-49947",
+            "description": "Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-49947"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--b35bcef5-045e-4c42-a09c-b90d720f7429.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--8f18f37a-aabb-4571-bfc4-730f7d89f1c4",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--b35bcef5-045e-4c42-a09c-b90d720f7429",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2023-12-04T00:17:12.288793Z",
+            "modified": "2023-12-04T00:17:12.288793Z",
+            "name": "CVE-2018-25094",
+            "description": "A vulnerability was found in ระบบบัญชีออนไลน์ Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unknown processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input ../../../etc/passwd leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The identifier of the patch is 9d9618422b980335bb30be612ea90f4f56cb992c. It is recommended to upgrade the affected component. The identifier VDB-246641 was assigned to this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2018-25094"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--b4328fb2-20b6-4faa-8392-cc3667798332.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--d5f96fa8-6a15-4693-a71c-6e37ff839c57",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--b4328fb2-20b6-4faa-8392-cc3667798332",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2023-12-04T00:17:17.852803Z",
+            "modified": "2023-12-04T00:17:17.852803Z",
+            "name": "CVE-2023-40692",
+            "description": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, 11.5 is vulnerable to denial of service under extreme stress conditions.  IBM X-Force ID:  264807.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-40692"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--e9c5d484-dde2-4f18-ae73-9025dc0e785d.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--97b07efd-afd9-4886-b121-cc9bf172a2e4",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--e9c5d484-dde2-4f18-ae73-9025dc0e785d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2023-12-04T00:17:10.906069Z",
+            "modified": "2023-12-04T00:17:10.906069Z",
+            "name": "CVE-2020-36768",
+            "description": "A vulnerability was found in rl-institut NESP2 Initial Release/1.0. It has been classified as critical. Affected is an unknown function of the file app/database.py. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 07c0cdf36cf6a4345086d07b54423723a496af5e. It is recommended to apply a patch to fix this issue. VDB-246642 is the identifier assigned to this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2020-36768"
+                }
+            ]
+        }
+    ]
+}