diff --git a/2024/50xxx/CVE-2024-50053.json b/2024/50xxx/CVE-2024-50053.json index f5ddc91c6f8..0ab7f70cc65 100644 --- a/2024/50xxx/CVE-2024-50053.json +++ b/2024/50xxx/CVE-2024-50053.json @@ -1,17 +1,118 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-50053", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@zohocorp.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Zohocorp ManageEngine ServiceDesk Plus versions\u00a0below\u00a014920\u00a0, ServiceDesk Plus MSP and SupportCentre Plus versions below\u00a014910 are vulnerable to Stored XSS in the task feature." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "ManageEngine", + "product": { + "product_data": [ + { + "product_name": "ServiceDesk Plus", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14910" + } + ] + } + }, + { + "product_name": "ServiceDesk Plus MSP", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14900" + } + ] + } + }, + { + "product_name": "SupportCentre Plus", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14900" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.manageengine.com/products/service-desk/CVE-2024-50053.html", + "refsource": "MISC", + "name": "https://www.manageengine.com/products/service-desk/CVE-2024-50053.html" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "EXTERNAL" + }, + "credits": [ + { + "lang": "en", + "value": "Dinh Vu" + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 6.3, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "LOW", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N", + "version": "3.1" } ] } diff --git a/2025/2xxx/CVE-2025-2311.json b/2025/2xxx/CVE-2025-2311.json index 82b1c392c52..ca7d34f4998 100644 --- a/2025/2xxx/CVE-2025-2311.json +++ b/2025/2xxx/CVE-2025-2311.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Nebula Informatics SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harvesting Information via API Event Monitoring.This issue affects SecHard: before 3.3.0.20220411." + "value": "Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harvesting Information via API Event Monitoring.This issue affects SecHard: before 3.3.0.20220411." } ] }, @@ -50,7 +50,7 @@ "vendor": { "vendor_data": [ { - "vendor_name": "Nebula Informatics", + "vendor_name": "Sechard Information Technologies", "product": { "product_data": [ { diff --git a/2025/2xxx/CVE-2025-2582.json b/2025/2xxx/CVE-2025-2582.json index 7b9c3560a72..e84e8aff727 100644 --- a/2025/2xxx/CVE-2025-2582.json +++ b/2025/2xxx/CVE-2025-2582.json @@ -1,17 +1,123 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-2582", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability was found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the file ManageAttachments.php. The manipulation of the argument Notice leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure." + }, + { + "lang": "deu", + "value": "Eine Schwachstelle wurde in SimpleMachines SMF 2.1.4 gefunden. Sie wurde als problematisch eingestuft. Dies betrifft einen unbekannten Teil der Datei ManageAttachments.php. Dank der Manipulation des Arguments Notice mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Cross Site Scripting", + "cweId": "CWE-79" + } + ] + }, + { + "description": [ + { + "lang": "eng", + "value": "Code Injection", + "cweId": "CWE-94" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SimpleMachines", + "product": { + "product_data": [ + { + "product_name": "SMF", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "2.1.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.300542", + "refsource": "MISC", + "name": "https://vuldb.com/?id.300542" + }, + { + "url": "https://vuldb.com/?ctiid.300542", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.300542" + }, + { + "url": "https://vuldb.com/?submit.511999", + "refsource": "MISC", + "name": "https://vuldb.com/?submit.511999" + }, + { + "url": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc3.md", + "refsource": "MISC", + "name": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc3.md" + }, + { + "url": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc4.md", + "refsource": "MISC", + "name": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc4.md" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Fewwords (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 3.5, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + }, + { + "version": "3.0", + "baseScore": 3.5, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + }, + { + "version": "2.0", + "baseScore": 4, + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N" } ] } diff --git a/2025/2xxx/CVE-2025-2583.json b/2025/2xxx/CVE-2025-2583.json index fa56ea72858..160a24311b4 100644 --- a/2025/2xxx/CVE-2025-2583.json +++ b/2025/2xxx/CVE-2025-2583.json @@ -1,17 +1,123 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-2583", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability was found in SimpleMachines SMF 2.1.4. It has been classified as problematic. This affects an unknown part of the file ManageNews.php. The manipulation of the argument subject/message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure." + }, + { + "lang": "deu", + "value": "Es wurde eine Schwachstelle in SimpleMachines SMF 2.1.4 ausgemacht. Sie wurde als problematisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Datei ManageNews.php. Dank Manipulation des Arguments subject/message mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Cross Site Scripting", + "cweId": "CWE-79" + } + ] + }, + { + "description": [ + { + "lang": "eng", + "value": "Code Injection", + "cweId": "CWE-94" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SimpleMachines", + "product": { + "product_data": [ + { + "product_name": "SMF", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "2.1.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.300543", + "refsource": "MISC", + "name": "https://vuldb.com/?id.300543" + }, + { + "url": "https://vuldb.com/?ctiid.300543", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.300543" + }, + { + "url": "https://vuldb.com/?submit.512001", + "refsource": "MISC", + "name": "https://vuldb.com/?submit.512001" + }, + { + "url": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc5.md", + "refsource": "MISC", + "name": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc5.md" + }, + { + "url": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc6.md", + "refsource": "MISC", + "name": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc6.md" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Fewwords (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 3.5, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + }, + { + "version": "3.0", + "baseScore": 3.5, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + }, + { + "version": "2.0", + "baseScore": 4, + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N" } ] } diff --git a/2025/2xxx/CVE-2025-2587.json b/2025/2xxx/CVE-2025-2587.json new file mode 100644 index 00000000000..6573c949985 --- /dev/null +++ b/2025/2xxx/CVE-2025-2587.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2025-2587", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2025/2xxx/CVE-2025-2588.json b/2025/2xxx/CVE-2025-2588.json new file mode 100644 index 00000000000..0affd1b7474 --- /dev/null +++ b/2025/2xxx/CVE-2025-2588.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2025-2588", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2025/2xxx/CVE-2025-2589.json b/2025/2xxx/CVE-2025-2589.json new file mode 100644 index 00000000000..661b22aae7e --- /dev/null +++ b/2025/2xxx/CVE-2025-2589.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2025-2589", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2025/2xxx/CVE-2025-2590.json b/2025/2xxx/CVE-2025-2590.json new file mode 100644 index 00000000000..9c18cc02b5e --- /dev/null +++ b/2025/2xxx/CVE-2025-2590.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2025-2590", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2025/2xxx/CVE-2025-2591.json b/2025/2xxx/CVE-2025-2591.json new file mode 100644 index 00000000000..22dd60fa70c --- /dev/null +++ b/2025/2xxx/CVE-2025-2591.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2025-2591", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2025/30xxx/CVE-2025-30346.json b/2025/30xxx/CVE-2025-30346.json new file mode 100644 index 00000000000..abb2362f22c --- /dev/null +++ b/2025/30xxx/CVE-2025-30346.json @@ -0,0 +1,62 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2025-30346", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://varnish-cache.org/security/VSV00015.html", + "refsource": "MISC", + "name": "https://varnish-cache.org/security/VSV00015.html" + } + ] + } +} \ No newline at end of file diff --git a/2025/30xxx/CVE-2025-30347.json b/2025/30xxx/CVE-2025-30347.json new file mode 100644 index 00000000000..6f206ed123d --- /dev/null +++ b/2025/30xxx/CVE-2025-30347.json @@ -0,0 +1,62 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2025-30347", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on ephemeral MSE4 stevedore objects." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://docs.varnish-software.com/security/VEV00001/", + "refsource": "MISC", + "name": "https://docs.varnish-software.com/security/VEV00001/" + } + ] + } +} \ No newline at end of file diff --git a/2025/30xxx/CVE-2025-30348.json b/2025/30xxx/CVE-2025-30348.json new file mode 100644 index 00000000000..50032375f91 --- /dev/null +++ b/2025/30xxx/CVE-2025-30348.json @@ -0,0 +1,62 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2025-30348", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data)." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://codereview.qt-project.org/c/qt/qtbase/+/581442", + "refsource": "MISC", + "name": "https://codereview.qt-project.org/c/qt/qtbase/+/581442" + } + ] + } +} \ No newline at end of file