generated content from 2024-11-05

mapping.csv

@@ -254572,3 +254572,13 @@ vulnerability,CVE-2024-48061,vulnerability--d24ca01e-baee-43db-94d7-4c7d21b917bc
 vulnerability,CVE-2024-48050,vulnerability--28de0d29-0306-484e-a7fe-ee4c7963b08a
 vulnerability,CVE-2024-48057,vulnerability--1c6a59b0-4eab-4b45-87d7-d45cb764018a
 vulnerability,CVE-2024-10805,vulnerability--f3bbd6e3-1f3e-4fd9-9d4c-50f6d03a73dd
+vulnerability,CVE-2024-51498,vulnerability--7d83995d-d3da-42a1-aab8-cc53d4bd963b
+vulnerability,CVE-2024-51500,vulnerability--c5b461af-ce11-4f85-9e02-4ebfd49285d2
+vulnerability,CVE-2024-10806,vulnerability--ca031053-3de4-44a3-bea3-e2ddc2ed57db
+vulnerability,CVE-2024-50346,vulnerability--0ba2edda-1076-489f-af10-3f71f5d54115
+vulnerability,CVE-2024-31998,vulnerability--b71124d4-ba25-426d-a458-2c1c9b36d2bf
+vulnerability,CVE-2024-31448,vulnerability--24c6e0cb-2f92-43b6-857d-22bbf4dbef60
+vulnerability,CVE-2024-32870,vulnerability--cc3e2245-3baf-4fbf-a942-89bdccf5117f
+vulnerability,CVE-2023-34443,vulnerability--f69ccb78-8fd6-4397-86fa-0e0aa993fd6a
+vulnerability,CVE-2023-34445,vulnerability--5bef80d2-88a9-4bfd-99b4-7fd37bd487f8
+vulnerability,CVE-2023-34444,vulnerability--ec34851c-34a3-4a99-9d3d-86e3d5c130a5

objects/vulnerability/vulnerability--0ba2edda-1076-489f-af10-3f71f5d54115.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--8c71888b-ccd3-4f66-be0f-7b46a88a8c00",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0ba2edda-1076-489f-af10-3f71f5d54115",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-05T01:23:49.276902Z",
+            "modified": "2024-11-05T01:23:49.276902Z",
+            "name": "CVE-2024-50346",
+            "description": "WebFeed is a lightweight web feed reader extension for Firefox/Chrome. Multiple HTML injection vulnerabilities in WebFeed can lead to CSRF and UI spoofing attacks. A remote attacker can provide malicious RSS feeds and attract the victim user to visit it using WebFeed. The attacker can then inject malicious HTML into the extension page and fool the victim into sending out HTTP requests to arbitrary sites with the victim's credentials. Users are vulnerable to CSRF attacks when visiting malicious RSS feeds via WebFeed. Unwanted actions could be executed on the user's behalf on arbitrary websites. This issue has been addressed in release version 0.9.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-50346"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--24c6e0cb-2f92-43b6-857d-22bbf4dbef60.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--9027b71c-1c10-4ee2-b396-178de4fb5d42",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--24c6e0cb-2f92-43b6-857d-22bbf4dbef60",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-05T01:23:49.954291Z",
+            "modified": "2024-11-05T01:23:49.954291Z",
+            "name": "CVE-2024-31448",
+            "description": "Combodo iTop is a simple, web based IT Service Management tool. By filling malicious code in a CSV content, an Cross-site Scripting (XSS) attack can be performed when importing this content. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. Users unable to upgrade should validate CSV content before importing it.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-31448"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--5bef80d2-88a9-4bfd-99b4-7fd37bd487f8.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b4a75025-091b-4981-8308-f6e2f2f55560",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--5bef80d2-88a9-4bfd-99b4-7fd37bd487f8",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-05T01:23:59.101588Z",
+            "modified": "2024-11-05T01:23:59.101588Z",
+            "name": "CVE-2023-34445",
+            "description": "Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.render.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-34445"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--7d83995d-d3da-42a1-aab8-cc53d4bd963b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--c25936e0-c712-4bf7-8dc4-ae2673420933",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--7d83995d-d3da-42a1-aab8-cc53d4bd963b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-05T01:23:48.800706Z",
+            "modified": "2024-11-05T01:23:48.800706Z",
+            "name": "CVE-2024-51498",
+            "description": "cobalt is a media downloader that doesn't piss you off. A malicious cobalt instance could serve links with the `javascript:` protocol, resulting in Cross-site Scripting (XSS) when the user tries to download an item from a picker. This issue has been present since commit `66bac03e`, was mitigated in commit `97977efa` (correctly configured web instances were no longer vulnerable) and fully fixed in commit `c4be1d3a` (included in release version 10.2.1). Users are advised to upgrade. Users unable to upgrade should enable a content-security-policy.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-51498"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--b71124d4-ba25-426d-a458-2c1c9b36d2bf.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--49059eef-7e0e-46b2-ac9c-17a3063d776b",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--b71124d4-ba25-426d-a458-2c1c9b36d2bf",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-05T01:23:49.931743Z",
+            "modified": "2024-11-05T01:23:49.931743Z",
+            "name": "CVE-2024-31998",
+            "description": "Combodo iTop is a simple, web based IT Service Management tool. A CSRF can be performed on CSV import simulation. This issue has been fixed in versions 3.1.2 and 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-31998"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--c5b461af-ce11-4f85-9e02-4ebfd49285d2.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--c61c434c-81ff-46d0-8b53-65a17bdcbda7",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--c5b461af-ce11-4f85-9e02-4ebfd49285d2",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-05T01:23:48.832045Z",
+            "modified": "2024-11-05T01:23:48.832045Z",
+            "name": "CVE-2024-51500",
+            "description": "Meshtastic firmware is a device firmware for the Meshtastic project. The Meshtastic firmware does not check for packets claiming to be from the special broadcast address (0xFFFFFFFF) which could result in unexpected behavior and potential for DDoS attacks on the network. A malicious actor could craft a packet to be from that address which would result in an amplification of this one message into every node on the network sending multiple messages. Such an attack could result in degraded network performance for all users as the available bandwidth is consumed. This issue has been addressed in release version 2.5.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-51500"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--ca031053-3de4-44a3-bea3-e2ddc2ed57db.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--8cfc147d-9fe5-4b8f-a680-a3a6ee8368d5",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--ca031053-3de4-44a3-bea3-e2ddc2ed57db",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-05T01:23:49.033154Z",
+            "modified": "2024-11-05T01:23:49.033154Z",
+            "name": "CVE-2024-10806",
+            "description": "A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as problematic. This vulnerability affects unknown code of the file betweendates-detailsreports.php. The manipulation of the argument fromdate/todate leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-10806"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--cc3e2245-3baf-4fbf-a942-89bdccf5117f.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--81942799-3b7b-4ba0-a764-371de731b477",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--cc3e2245-3baf-4fbf-a942-89bdccf5117f",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-05T01:23:50.634824Z",
+            "modified": "2024-11-05T01:23:50.634824Z",
+            "name": "CVE-2024-32870",
+            "description": "Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-32870"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--ec34851c-34a3-4a99-9d3d-86e3d5c130a5.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b41e347c-7ce1-4309-9dee-7fadd964c9dd",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--ec34851c-34a3-4a99-9d3d-86e3d5c130a5",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-05T01:23:59.133177Z",
+            "modified": "2024-11-05T01:23:59.133177Z",
+            "name": "CVE-2023-34444",
+            "description": "Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.searchform.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-34444"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--f69ccb78-8fd6-4397-86fa-0e0aa993fd6a.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--e896ef00-6e0c-42d3-a39a-0bc1f6908a44",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--f69ccb78-8fd6-4397-86fa-0e0aa993fd6a",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-05T01:23:59.084066Z",
+            "modified": "2024-11-05T01:23:59.084066Z",
+            "name": "CVE-2023-34443",
+            "description": "Combodo iTop is a simple, web based IT Service Management tool. When displaying page Run queries Cross-site Scripting (XSS) are possible for scripts outside of script tags. This has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-34443"
+                }
+            ]
+        }
+    ]
+}