Skip to content
This repository was archived by the owner on May 14, 2024. It is now read-only.

Commit 5e58865

Browse files
ahouseholderahouseholder
committed
Merge branch 'release/2019_05_14'
2 parents 74d0d3e + a48cadb commit 5e58865

File tree

1,152 files changed

+18687
-722
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,152 files changed

+18687
-722
lines changed

‎LICENSE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Copyright ©2018 Carnegie Mellon University.
1+
Copyright ©2019 Carnegie Mellon University.
22

33
This archive is funded and supported by Department of Homeland Security
44
under Contract No. FA8721-05-C-0003 with Carnegie Mellon University for

‎README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
# CERT Coordination Center Vulnerability Data Archive
22

3-
Release 2018-11-06
3+
Release 2019-05-14
44

55

66
### Change Log ###
77

8+
2019-05-14 Updated data
9+
810
2018-11-06 Updated data
911

1012
2018-01-30 Updated data

‎data/0/vu_990900/vu_990900.json‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -12,26 +12,26 @@
1212
"CAM_WidelyKnown": "0",
1313
"CERTAdvisory": "",
1414
"CVEIDs": "CVE-2003-0702",
15-
"CVSS_AccessComplexity": "",
16-
"CVSS_AccessVector": "",
17-
"CVSS_Authenication": "",
18-
"CVSS_AvailabilityImpact": "",
19-
"CVSS_BaseScore": "",
20-
"CVSS_BaseVector": "",
21-
"CVSS_CollateralDamagePotential": "",
22-
"CVSS_ConfidentialityImpact": "",
23-
"CVSS_EnvironmentalScore": "",
24-
"CVSS_EnvironmentalVector": "",
25-
"CVSS_Exploitability": "",
26-
"CVSS_IntegrityImpact": "",
27-
"CVSS_RemediationLevel": "",
28-
"CVSS_ReportConfidence": "",
29-
"CVSS_SecurityRequirementsAR": "",
30-
"CVSS_SecurityRequirementsCR": "",
31-
"CVSS_SecurityRequirementsIR": "",
32-
"CVSS_TargetDistribution": "",
33-
"CVSS_TemporalScore": "",
34-
"CVSS_TemporalVector": "",
15+
"CVSS_AccessComplexity": "--",
16+
"CVSS_AccessVector": "--",
17+
"CVSS_Authenication": "--",
18+
"CVSS_AvailabilityImpact": "--",
19+
"CVSS_BaseScore": 0,
20+
"CVSS_BaseVector": "AV:--/AC:--/Au:--/C:--/I:--/A:--",
21+
"CVSS_CollateralDamagePotential": "Not Defined (ND)",
22+
"CVSS_ConfidentialityImpact": "--",
23+
"CVSS_EnvironmentalScore": 0,
24+
"CVSS_EnvironmentalVector": "CDP:Not Defined (ND)/TD:Not Defined (ND)/CR:Not Defined (ND)/IR:Not Defined (ND)/AR:Not Defined (ND)",
25+
"CVSS_Exploitability": "Not Defined (ND)",
26+
"CVSS_IntegrityImpact": "--",
27+
"CVSS_RemediationLevel": "Not Defined (ND)",
28+
"CVSS_ReportConfidence": "Not Defined (ND)",
29+
"CVSS_SecurityRequirementsAR": "Not Defined (ND)",
30+
"CVSS_SecurityRequirementsCR": "Not Defined (ND)",
31+
"CVSS_SecurityRequirementsIR": "Not Defined (ND)",
32+
"CVSS_TargetDistribution": "Not Defined (ND)",
33+
"CVSS_TemporalScore": 0,
34+
"CVSS_TemporalVector": "E:Not Defined (ND)/RL:Not Defined (ND)/RC:Not Defined (ND)",
3535
"DateCreated": "2003-09-05T13:30:06-04:00",
3636
"DateFirstPublished": "",
3737
"DateLastUpdated": "2003-11-19T11:44:00-05:00",

‎data/1/vu_176301/vu_176301.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
"CVSS_TemporalVector": "E:ND/RL:ND/RC:ND",
4040
"DateCreated": "2018-09-10T10:06:43-04:00",
4141
"DateFirstPublished": "2018-10-06T19:34:55-04:00",
42-
"DateLastUpdated": "2018-10-16T14:52:00-04:00",
42+
"DateLastUpdated": "2018-12-11T09:21:00-05:00",
4343
"DatePublic": "2018-10-06T00:00:00",
4444
"Description": "CWE 798: \u200bUse of Hard-Coded Credentials - CVE\u20132018-5399\nThe DCU 210E firmware contains an undocumented Dropbear SSH server with a hardcoded username and password. The password is easily susceptible to cracking. CWE-346:\u200bOrigin Validation Error - CVE\u20132018-5400\nThe Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices. CWE-319:\u200b Cleartext Transmission of Sensitive Information - CVE\u20132018-5401\nThe devices transmit process control information via unencrypted Modbus communications. CWE-319:\u200b Cleartext Transmission of Sensitive Information - CVE\u20132018-5402\nThe embedded webserver uses unencrypted plaintext for the transmission of the administrator PIN.",
4545
"ID": "VU#176301",
@@ -50,7 +50,7 @@
5050
"Overview": "Auto-Maskin RP remote panels and DCU controls units are used to monitor and control ship engines. The units have several authentication and encryption vulnerabilities which can allow attackers to access the units and control connected engines.",
5151
"References": "",
5252
"Resolution": "CERT/CC is currently unaware of an update to address the vulnerabilities.",
53-
"Revision": 14,
53+
"Revision": 16,
5454
"SystemsAffectedPreamble": "",
5555
"ThanksAndCredit": "Thanks to Brian Satira and Brian Olson for reporting this vulnerability.",
5656
"Title": "Auto-Maskin DCU 210E RP 210E and Marine Pro Observer App",

‎data/11/vu_581311/vu_581311.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
"CVSS_TemporalVector": "E:POC/RL:OF/RC:C",
3838
"DateCreated": "2018-06-28T11:57:32-04:00",
3939
"DateFirstPublished": "2018-09-26T09:07:40-04:00",
40-
"DateLastUpdated": "2018-10-30T08:43:00-04:00",
40+
"DateLastUpdated": "2018-11-08T13:58:00-05:00",
4141
"DatePublic": "2018-09-18T00:00:00",
4242
"Description": "CWE-306: Missing Authentication for Critical Function - CVE-2018-5393 EAP Controller for Linux utilizes a Java remote method invocation (RMI) service for remote control. The RMI interface does not require any authentication before use. Remote attackers can implement deserialization attacks through the RMI protocol. Successful attacks may allow a remote attacker to remotely control the target server and execute Java functions or bytecode. CWE-502: Deserialization of Untrusted Data - CVE-2015-6420 EAP Controller for Linux bundles a vulnerable version of Apache commons-collections v3.2.1 with the software, which appears to be the root cause of the vulnerability. Therefore, EAP Controller v2.5.3 and earlier are vulnerable to CVE-2015-6420 as documented in VU#576313. EAP Controller v2.5.3 and earlier for Linux are affected by both vulnerabilities.",
4343
"ID": "VU#581311",
@@ -59,8 +59,8 @@
5959
"http://cwe.mitre.org/data/definitions/306.html",
6060
"http://cwe.mitre.org/data/definitions/502.html"
6161
],
62-
"Resolution": "There is currently no available update to EAP Controller to fully address the vulnerability. However, affected users may take the following actions to help mitigate and reduce risk. As described in VU#576313, updating the vulnerable libraries does not necessarily eliminate the vulnerability in all scenarios.",
63-
"Revision": 97,
62+
"Resolution": "The Omada Controller software v3.0.2 and later are not affected by this issue. Software download is available on the TP-Link support website. If older software must be used, users can help mitigate and reduce risk by updating the vulnerable libraries does not necessarily eliminate the vulnerability in all scenarios, as described in As described in VU#576313.",
63+
"Revision": 103,
6464
"SystemsAffectedPreamble": "",
6565
"ThanksAndCredit": "Thanks to Liu Zhu, of Huawei Weiran Lab for reporting this vulnerability.",
6666
"Title": "TP-Link EAP Controller lacks RMI authentication and is vulnerable to deserialization attacks",

‎data/11/vu_991211/vu_991211.json‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -15,26 +15,26 @@
1515
"CVE-2008-5077",
1616
"CVE-2009-0021"
1717
],
18-
"CVSS_AccessComplexity": "",
19-
"CVSS_AccessVector": "",
20-
"CVSS_Authenication": "",
21-
"CVSS_AvailabilityImpact": "",
22-
"CVSS_BaseScore": "",
23-
"CVSS_BaseVector": "",
24-
"CVSS_CollateralDamagePotential": "",
25-
"CVSS_ConfidentialityImpact": "",
26-
"CVSS_EnvironmentalScore": "",
27-
"CVSS_EnvironmentalVector": "",
28-
"CVSS_Exploitability": "",
29-
"CVSS_IntegrityImpact": "",
30-
"CVSS_RemediationLevel": "",
31-
"CVSS_ReportConfidence": "",
32-
"CVSS_SecurityRequirementsAR": "",
33-
"CVSS_SecurityRequirementsCR": "",
34-
"CVSS_SecurityRequirementsIR": "",
35-
"CVSS_TargetDistribution": "",
36-
"CVSS_TemporalScore": "",
37-
"CVSS_TemporalVector": "",
18+
"CVSS_AccessComplexity": "--",
19+
"CVSS_AccessVector": "--",
20+
"CVSS_Authenication": "--",
21+
"CVSS_AvailabilityImpact": "--",
22+
"CVSS_BaseScore": 0,
23+
"CVSS_BaseVector": "AV:--/AC:--/Au:--/C:--/I:--/A:--",
24+
"CVSS_CollateralDamagePotential": "Not Defined (ND)",
25+
"CVSS_ConfidentialityImpact": "--",
26+
"CVSS_EnvironmentalScore": 0,
27+
"CVSS_EnvironmentalVector": "CDP:Not Defined (ND)/TD:Not Defined (ND)/CR:Not Defined (ND)/IR:Not Defined (ND)/AR:Not Defined (ND)",
28+
"CVSS_Exploitability": "Not Defined (ND)",
29+
"CVSS_IntegrityImpact": "--",
30+
"CVSS_RemediationLevel": "Not Defined (ND)",
31+
"CVSS_ReportConfidence": "Not Defined (ND)",
32+
"CVSS_SecurityRequirementsAR": "Not Defined (ND)",
33+
"CVSS_SecurityRequirementsCR": "Not Defined (ND)",
34+
"CVSS_SecurityRequirementsIR": "Not Defined (ND)",
35+
"CVSS_TargetDistribution": "Not Defined (ND)",
36+
"CVSS_TemporalScore": 0,
37+
"CVSS_TemporalVector": "E:Not Defined (ND)/RL:Not Defined (ND)/RC:Not Defined (ND)",
3838
"DateCreated": "2009-01-08T10:50:49-05:00",
3939
"DateFirstPublished": "",
4040
"DateLastUpdated": "2009-01-09T10:20:00-05:00",

‎data/13/vu_608413/vu_608413.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"Author": "This document was written by [Unassigned].",
3+
"CAM_AttackerAccessRequired": "0",
4+
"CAM_EaseOfExploitation": "0",
5+
"CAM_Exploitation": "0",
6+
"CAM_Impact": "0",
7+
"CAM_InternetInfrastructure": "0",
8+
"CAM_Population": "0",
9+
"CAM_ScoreCurrent": 0,
10+
"CAM_ScoreCurrentWidelyKnown": 0,
11+
"CAM_ScoreCurrentWidelyKnownExploited": 0,
12+
"CAM_WidelyKnown": "0",
13+
"CERTAdvisory": "",
14+
"CVEIDs": "",
15+
"CVSS_AccessComplexity": "--",
16+
"CVSS_AccessVector": "--",
17+
"CVSS_Authenication": "--",
18+
"CVSS_AvailabilityImpact": "--",
19+
"CVSS_BaseScore": 0,
20+
"CVSS_BaseVector": "AV:--/AC:--/Au:--/C:--/I:--/A:--",
21+
"CVSS_CollateralDamagePotential": "ND",
22+
"CVSS_ConfidentialityImpact": "--",
23+
"CVSS_EnvironmentalScore": 0,
24+
"CVSS_EnvironmentalVector": "CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND",
25+
"CVSS_Exploitability": "ND",
26+
"CVSS_IntegrityImpact": "--",
27+
"CVSS_RemediationLevel": "ND",
28+
"CVSS_ReportConfidence": "ND",
29+
"CVSS_SecurityRequirementsAR": "ND",
30+
"CVSS_SecurityRequirementsCR": "ND",
31+
"CVSS_SecurityRequirementsIR": "ND",
32+
"CVSS_TargetDistribution": "ND",
33+
"CVSS_TemporalScore": 0,
34+
"CVSS_TemporalVector": "E:ND/RL:ND/RC:ND",
35+
"DateCreated": "2019-05-09T09:06:37-04:00",
36+
"DateFirstPublished": "",
37+
"DateLastUpdated": "2019-05-09T14:58:00-04:00",
38+
"DatePublic": "",
39+
"Description": "",
40+
"ID": "VU#608413",
41+
"IDNumber": "608413",
42+
"IPProtocol": "",
43+
"Impact": "The complete impact of this vulnerability is not yet known.",
44+
"Keywords": [
45+
"Jay Angus",
46+
"ICS-CERT",
47+
"Report #15"
48+
],
49+
"Overview": "",
50+
"References": "",
51+
"Resolution": "The CERT/CC is currently unaware of a practical solution to this problem.",
52+
"Revision": 5,
53+
"SystemsAffectedPreamble": "",
54+
"ThanksAndCredit": "",
55+
"Title": "Neptune web page suffers from broken authentication",
56+
"US-CERTTechnicalAlert": "",
57+
"VRDA_D1_DirectReport": "0",
58+
"VRDA_D1_Impact": "",
59+
"VRDA_D1_Population": "",
60+
"VulnerabilityCount": 1,
61+
"Workarounds": ""
62+
}

‎data/13/vu_756913/vendor_molr-b7ehxb.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"Addendum": "There are no additional comments at this time.",
3+
"DateLastUpdated": "2018-12-13T08:35:00-05:00",
4+
"DateNotified": "2018-12-05T00:00:00",
5+
"DateResponded": "",
6+
"ID": "VU#756913",
7+
"Revision": 1,
8+
"Status": "Affected",
9+
"Vendor": "Pixar Animation Studios",
10+
"VendorInformation": "We are not aware of further vendor information regarding this vulnerability.",
11+
"VendorRecordID": "MOLR-B7EHXB",
12+
"VendorReferences": "None",
13+
"VendorStatement": "No statement is currently available from the vendor regarding this vulnerability."
14+
}

‎data/13/vu_756913/vu_756913.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"Author": "This document was written by Madison Oliver.",
3+
"CAM_AttackerAccessRequired": "0",
4+
"CAM_EaseOfExploitation": "0",
5+
"CAM_Exploitation": "0",
6+
"CAM_Impact": "0",
7+
"CAM_InternetInfrastructure": "0",
8+
"CAM_Population": "0",
9+
"CAM_ScoreCurrent": 0,
10+
"CAM_ScoreCurrentWidelyKnown": 0,
11+
"CAM_ScoreCurrentWidelyKnownExploited": 0,
12+
"CAM_WidelyKnown": "0",
13+
"CERTAdvisory": "",
14+
"CVEIDs": "CVE-2018-5411",
15+
"CVSS_AccessComplexity": "L",
16+
"CVSS_AccessVector": "L",
17+
"CVSS_Authenication": "S",
18+
"CVSS_AvailabilityImpact": "P",
19+
"CVSS_BaseScore": 3.2,
20+
"CVSS_BaseVector": "AV:L/AC:L/Au:S/C:N/I:P/A:P",
21+
"CVSS_CollateralDamagePotential": "L",
22+
"CVSS_ConfidentialityImpact": "N",
23+
"CVSS_EnvironmentalScore": 0.81340236580705,
24+
"CVSS_EnvironmentalVector": "CDP:L/TD:L/CR:ND/IR:ND/AR:ND",
25+
"CVSS_Exploitability": "POC",
26+
"CVSS_IntegrityImpact": "P",
27+
"CVSS_RemediationLevel": "OF",
28+
"CVSS_ReportConfidence": "C",
29+
"CVSS_SecurityRequirementsAR": "ND",
30+
"CVSS_SecurityRequirementsCR": "ND",
31+
"CVSS_SecurityRequirementsIR": "ND",
32+
"CVSS_TargetDistribution": "L",
33+
"CVSS_TemporalScore": 2.5,
34+
"CVSS_TemporalVector": "E:POC/RL:OF/RC:C",
35+
"DateCreated": "2018-08-20T08:47:03-04:00",
36+
"DateFirstPublished": "2018-12-13T09:12:46-05:00",
37+
"DateLastUpdated": "2019-01-28T12:04:00-05:00",
38+
"DatePublic": "2018-12-12T00:00:00",
39+
"Description": "Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability (CWE-79) in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert JavaScript into this note field that is then saved and displayed to the end user.",
40+
"ID": "VU#756913",
41+
"IDNumber": "756913",
42+
"IPProtocol": "",
43+
"Impact": "An authenticated attacker might include JavaScript that could execute on an authenticated user's system, which could lead to website redirects, session cookie hijacking, social engineering, and other impacts. Since the attacker's script is stored with the information about the node, all other users with access to this data are also vulnerable.",
44+
"Keywords": [
45+
"Pixar",
46+
"Tractor",
47+
"rendering software",
48+
"stored XSS",
49+
"CVE-2018-5411"
50+
],
51+
"Overview": "Pixar's Tractor network rendering software is vulnerable to stored cross-site scripting which may allow an attacker to execute arbitrary JavaScript.",
52+
"References": [
53+
"https://cwe.mitre.org/data/definitions/79.html",
54+
"https://renderman.pixar.com/product/tractor"
55+
],
56+
"Resolution": "Apply an update\nPixar has released an updated version of this software that addresses this vulnerability, Tractor version 2.3 (build 1923604). Affected users should update to this version.",
57+
"Revision": 55,
58+
"SystemsAffectedPreamble": "",
59+
"ThanksAndCredit": "Thanks to the reporter who wishes to remain anonymous.",
60+
"Title": "Pixar Tractor contains a stored cross-site scripting vulnerability",
61+
"US-CERTTechnicalAlert": "",
62+
"VRDA_D1_DirectReport": "1",
63+
"VRDA_D1_Impact": "",
64+
"VRDA_D1_Population": "1",
65+
"VulnerabilityCount": 1,
66+
"Workarounds": ""
67+
}

‎data/13/vu_990913/vu_990913.json‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -12,26 +12,26 @@
1212
"CAM_WidelyKnown": "0",
1313
"CERTAdvisory": "",
1414
"CVEIDs": "",
15-
"CVSS_AccessComplexity": "",
16-
"CVSS_AccessVector": "",
17-
"CVSS_Authenication": "",
18-
"CVSS_AvailabilityImpact": "",
19-
"CVSS_BaseScore": "",
20-
"CVSS_BaseVector": "",
21-
"CVSS_CollateralDamagePotential": "",
22-
"CVSS_ConfidentialityImpact": "",
23-
"CVSS_EnvironmentalScore": "",
24-
"CVSS_EnvironmentalVector": "",
25-
"CVSS_Exploitability": "",
26-
"CVSS_IntegrityImpact": "",
27-
"CVSS_RemediationLevel": "",
28-
"CVSS_ReportConfidence": "",
29-
"CVSS_SecurityRequirementsAR": "",
30-
"CVSS_SecurityRequirementsCR": "",
31-
"CVSS_SecurityRequirementsIR": "",
32-
"CVSS_TargetDistribution": "",
33-
"CVSS_TemporalScore": "",
34-
"CVSS_TemporalVector": "",
15+
"CVSS_AccessComplexity": "--",
16+
"CVSS_AccessVector": "--",
17+
"CVSS_Authenication": "--",
18+
"CVSS_AvailabilityImpact": "--",
19+
"CVSS_BaseScore": 0,
20+
"CVSS_BaseVector": "AV:--/AC:--/Au:--/C:--/I:--/A:--",
21+
"CVSS_CollateralDamagePotential": "Not Defined (ND)",
22+
"CVSS_ConfidentialityImpact": "--",
23+
"CVSS_EnvironmentalScore": 0,
24+
"CVSS_EnvironmentalVector": "CDP:Not Defined (ND)/TD:Not Defined (ND)/CR:Not Defined (ND)/IR:Not Defined (ND)/AR:Not Defined (ND)",
25+
"CVSS_Exploitability": "Not Defined (ND)",
26+
"CVSS_IntegrityImpact": "--",
27+
"CVSS_RemediationLevel": "Not Defined (ND)",
28+
"CVSS_ReportConfidence": "Not Defined (ND)",
29+
"CVSS_SecurityRequirementsAR": "Not Defined (ND)",
30+
"CVSS_SecurityRequirementsCR": "Not Defined (ND)",
31+
"CVSS_SecurityRequirementsIR": "Not Defined (ND)",
32+
"CVSS_TargetDistribution": "Not Defined (ND)",
33+
"CVSS_TemporalScore": 0,
34+
"CVSS_TemporalVector": "E:Not Defined (ND)/RL:Not Defined (ND)/RC:Not Defined (ND)",
3535
"DateCreated": "2007-06-04T07:26:19-04:00",
3636
"DateFirstPublished": "",
3737
"DateLastUpdated": "2007-06-04T07:29:00-04:00",

0 commit comments

Comments
 (0)