diff --git a/2024/13xxx/CVE-2024-13207.json b/2024/13xxx/CVE-2024-13207.json index caf3a942161..d03c661b4b4 100644 --- a/2024/13xxx/CVE-2024-13207.json +++ b/2024/13xxx/CVE-2024-13207.json @@ -1,18 +1,80 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-13207", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "contact@wpscan.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Cross-Site Scripting (XSS)" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Unknown", + "product": { + "product_data": [ + { + "product_name": "Widget for Social Page Feeds", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "0", + "version_value": "6.4.2" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://wpscan.com/vulnerability/c3e27fa2-b6dd-48eb-83ec-99dc034eff38/", + "refsource": "MISC", + "name": "https://wpscan.com/vulnerability/c3e27fa2-b6dd-48eb-83ec-99dc034eff38/" + } + ] + }, + "generator": { + "engine": "WPScan CVE Generator" + }, + "source": { + "discovery": "EXTERNAL" + }, + "credits": [ + { + "lang": "en", + "value": "Krugov Artyom" + }, + { + "lang": "en", + "value": "WPScan" + } + ] } \ No newline at end of file diff --git a/2025/2xxx/CVE-2025-2225.json b/2025/2xxx/CVE-2025-2225.json index 136709a0708..54f9d6b276c 100644 --- a/2025/2xxx/CVE-2025-2225.json +++ b/2025/2xxx/CVE-2025-2225.json @@ -1,17 +1,95 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-2225", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The Responsive Addons for Elementor \u2013 Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018rael_title_tag' parameter in all versions up to, and including, 1.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 1.6.9." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "cyberchimps", + "product": { + "product_data": [ + { + "product_name": "Responsive Addons for Elementor \u2013 Free Elementor Addons Plugin and Elementor Templates", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "1.6.9" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ace7fb-530e-4a69-bbf7-e2c66491dd75?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ace7fb-530e-4a69-bbf7-e2c66491dd75?source=cve" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/responsive-addons-for-elementor/trunk/includes/widgets-manager/widgets/class-responsive-addons-for-elementor-icon-box.php#L2499", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/browser/responsive-addons-for-elementor/trunk/includes/widgets-manager/widgets/class-responsive-addons-for-elementor-icon-box.php#L2499" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3261241/", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/changeset/3261241/" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3263280/", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/changeset/3263280/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Prissy Mesh" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", + "baseScore": 6.4, + "baseSeverity": "MEDIUM" } ] } diff --git a/2025/32xxx/CVE-2025-32993.json b/2025/32xxx/CVE-2025-32993.json index 59070e25aa2..2bee27063e1 100644 --- a/2025/32xxx/CVE-2025-32993.json +++ b/2025/32xxx/CVE-2025-32993.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2025-32993", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2025-32993", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis_username parameter. Authentication is not needed." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://nav1n.medium.com/sql-injection-in-vision-helpdesk-tools-a83dfc27f3ab", + "refsource": "MISC", + "name": "https://nav1n.medium.com/sql-injection-in-vision-helpdesk-tools-a83dfc27f3ab" + }, + { + "refsource": "MISC", + "name": "https://www.visionhelpdesk.com/vision-helpdesk-v5-7-0-stable-version-released.html", + "url": "https://www.visionhelpdesk.com/vision-helpdesk-v5-7-0-stable-version-released.html" } ] } diff --git a/2025/3xxx/CVE-2025-3576.json b/2025/3xxx/CVE-2025-3576.json index a9e652e2267..f440d40ae00 100644 --- a/2025/3xxx/CVE-2025-3576.json +++ b/2025/3xxx/CVE-2025-3576.json @@ -1,17 +1,177 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-3576", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Use of Weak Hash", + "cweId": "CWE-328" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Red Hat", + "product": { + "product_data": [ + { + "product_name": "Red Hat Ansible Automation Platform 2", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "defaultStatus": "affected" + } + }, + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "defaultStatus": "affected" + } + }, + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "defaultStatus": "affected" + } + }, + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "defaultStatus": "affected" + } + }, + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "defaultStatus": "affected" + } + } + ] + } + }, + { + "product_name": "Red Hat Enterprise Linux 6", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "defaultStatus": "affected" + } + } + ] + } + }, + { + "product_name": "Red Hat Enterprise Linux 7", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "defaultStatus": "affected" + } + } + ] + } + }, + { + "product_name": "Red Hat Enterprise Linux 8", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "defaultStatus": "affected" + } + } + ] + } + }, + { + "product_name": "Red Hat Enterprise Linux 9", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "defaultStatus": "affected" + } + } + ] + } + }, + { + "product_name": "Red Hat OpenShift Container Platform 4", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "defaultStatus": "affected" + } + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://access.redhat.com/security/cve/CVE-2025-3576", + "refsource": "MISC", + "name": "https://access.redhat.com/security/cve/CVE-2025-3576" + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359465", + "refsource": "MISC", + "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2359465" + } + ] + }, + "impact": { + "cvss": [ + { + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 5.9, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", + "version": "3.1" } ] } diff --git a/2025/3xxx/CVE-2025-3622.json b/2025/3xxx/CVE-2025-3622.json index fc52d645967..1bf5bdedcea 100644 --- a/2025/3xxx/CVE-2025-3622.json +++ b/2025/3xxx/CVE-2025-3622.json @@ -1,17 +1,127 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-3622", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability, which was classified as critical, has been found in Xorbits Inference up to 1.4.1. This issue affects the function load of the file xinference/thirdparty/cosyvoice/cli/model.py. The manipulation leads to deserialization." + }, + { + "lang": "deu", + "value": "Eine Schwachstelle wurde in Xorbits Inference bis 1.4.1 entdeckt. Sie wurde als kritisch eingestuft. Hierbei geht es um die Funktion load der Datei xinference/thirdparty/cosyvoice/cli/model.py. Dank Manipulation mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Deserialization", + "cweId": "CWE-502" + } + ] + }, + { + "description": [ + { + "lang": "eng", + "value": "Improper Input Validation", + "cweId": "CWE-20" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Xorbits", + "product": { + "product_data": [ + { + "product_name": "Inference", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "1.4.0" + }, + { + "version_affected": "=", + "version_value": "1.4.1" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.304679", + "refsource": "MISC", + "name": "https://vuldb.com/?id.304679" + }, + { + "url": "https://vuldb.com/?ctiid.304679", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.304679" + }, + { + "url": "https://vuldb.com/?submit.552245", + "refsource": "MISC", + "name": "https://vuldb.com/?submit.552245" + }, + { + "url": "https://github.com/xorbitsai/inference/issues/3190", + "refsource": "MISC", + "name": "https://github.com/xorbitsai/inference/issues/3190" + }, + { + "url": "https://github.com/xorbitsai/inference/issues/3190#issuecomment-2783462266", + "refsource": "MISC", + "name": "https://github.com/xorbitsai/inference/issues/3190#issuecomment-2783462266" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "ybdesire (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 5.5, + "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 5.5, + "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 5.2, + "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P" } ] }