From 6c542af0442c504ba799b3902a74074bfef6d005 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Mon, 7 Apr 2025 17:00:31 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2024/58xxx/CVE-2024-58134.json | 18 ++++++ 2024/58xxx/CVE-2024-58135.json | 18 ++++++ 2025/2xxx/CVE-2025-2877.json | 47 ++++++++++++++ 2025/3xxx/CVE-2025-3374.json | 109 +++++++++++++++++++++++++++++++-- 2025/3xxx/CVE-2025-3375.json | 109 +++++++++++++++++++++++++++++++-- 2025/3xxx/CVE-2025-3425.json | 72 ++++++++++++++++++++-- 2025/3xxx/CVE-2025-3426.json | 91 +++++++++++++++++++++++++++ 7 files changed, 451 insertions(+), 13 deletions(-) create mode 100644 2024/58xxx/CVE-2024-58134.json create mode 100644 2024/58xxx/CVE-2024-58135.json create mode 100644 2025/3xxx/CVE-2025-3426.json diff --git a/2024/58xxx/CVE-2024-58134.json b/2024/58xxx/CVE-2024-58134.json new file mode 100644 index 00000000000..f2e4ecf8dc0 --- /dev/null +++ b/2024/58xxx/CVE-2024-58134.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-58134", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/58xxx/CVE-2024-58135.json b/2024/58xxx/CVE-2024-58135.json new file mode 100644 index 00000000000..5de55e04f64 --- /dev/null +++ b/2024/58xxx/CVE-2024-58135.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-58135", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2025/2xxx/CVE-2025-2877.json b/2025/2xxx/CVE-2025-2877.json index 56ae9b4a7bf..f2be54da544 100644 --- a/2025/2xxx/CVE-2025-2877.json +++ b/2025/2xxx/CVE-2025-2877.json @@ -76,6 +76,48 @@ } ] } + }, + { + "product_name": "Red Hat Ansible Automation Platform 2.5 for RHEL 8", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "versions": [ + { + "version": "0:1.1.4-2.el8ap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "defaultStatus": "affected" + } + } + ] + } + }, + { + "product_name": "Red Hat Ansible Automation Platform 2.5 for RHEL 9", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "versions": [ + { + "version": "0:1.1.4-2.el9ap", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "defaultStatus": "affected" + } + } + ] + } } ] } @@ -90,6 +132,11 @@ "refsource": "MISC", "name": "https://access.redhat.com/errata/RHSA-2025:3636" }, + { + "url": "https://access.redhat.com/errata/RHSA-2025:3637", + "refsource": "MISC", + "name": "https://access.redhat.com/errata/RHSA-2025:3637" + }, { "url": "https://access.redhat.com/security/cve/CVE-2025-2877", "refsource": "MISC", diff --git a/2025/3xxx/CVE-2025-3374.json b/2025/3xxx/CVE-2025-3374.json index e2968ee53f1..0ff00f0e803 100644 --- a/2025/3xxx/CVE-2025-3374.json +++ b/2025/3xxx/CVE-2025-3374.json @@ -1,17 +1,118 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-3374", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component CCC Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used." + }, + { + "lang": "deu", + "value": "Eine Schwachstelle wurde in PCMan FTP Server 2.0.7 gefunden. Sie wurde als kritisch eingestuft. Davon betroffen ist unbekannter Code der Komponente CCC Command Handler. Durch das Beeinflussen mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Buffer Overflow", + "cweId": "CWE-120" + } + ] + }, + { + "description": [ + { + "lang": "eng", + "value": "Memory Corruption", + "cweId": "CWE-119" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "PCMan", + "product": { + "product_data": [ + { + "product_name": "FTP Server", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "2.0.7" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.303620", + "refsource": "MISC", + "name": "https://vuldb.com/?id.303620" + }, + { + "url": "https://vuldb.com/?ctiid.303620", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.303620" + }, + { + "url": "https://vuldb.com/?submit.552336", + "refsource": "MISC", + "name": "https://vuldb.com/?submit.552336" + }, + { + "url": "https://fitoxs.com/exploit/exploit-e4f29cda8e801f1b0e7fcf539e4352b4.txt", + "refsource": "MISC", + "name": "https://fitoxs.com/exploit/exploit-e4f29cda8e801f1b0e7fcf539e4352b4.txt" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Fernando Mengali (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 7.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "HIGH" + }, + { + "version": "3.0", + "baseScore": 7.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "HIGH" + }, + { + "version": "2.0", + "baseScore": 7.5, + "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P" } ] } diff --git a/2025/3xxx/CVE-2025-3375.json b/2025/3xxx/CVE-2025-3375.json index 1471a58a54a..f0fb4b5c743 100644 --- a/2025/3xxx/CVE-2025-3375.json +++ b/2025/3xxx/CVE-2025-3375.json @@ -1,17 +1,118 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-3375", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component CDUP Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used." + }, + { + "lang": "deu", + "value": "Es wurde eine Schwachstelle in PCMan FTP Server 2.0.7 ausgemacht. Sie wurde als kritisch eingestuft. Hiervon betroffen ist ein unbekannter Codeblock der Komponente CDUP Command Handler. Durch Beeinflussen mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Buffer Overflow", + "cweId": "CWE-120" + } + ] + }, + { + "description": [ + { + "lang": "eng", + "value": "Memory Corruption", + "cweId": "CWE-119" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "PCMan", + "product": { + "product_data": [ + { + "product_name": "FTP Server", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "2.0.7" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.303621", + "refsource": "MISC", + "name": "https://vuldb.com/?id.303621" + }, + { + "url": "https://vuldb.com/?ctiid.303621", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.303621" + }, + { + "url": "https://vuldb.com/?submit.552337", + "refsource": "MISC", + "name": "https://vuldb.com/?submit.552337" + }, + { + "url": "https://fitoxs.com/exploit/exploit-b81a4a56b5d867bc810b183e3c9791ef.txt", + "refsource": "MISC", + "name": "https://fitoxs.com/exploit/exploit-b81a4a56b5d867bc810b183e3c9791ef.txt" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Fernando Mengali (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 7.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "HIGH" + }, + { + "version": "3.0", + "baseScore": 7.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "HIGH" + }, + { + "version": "2.0", + "baseScore": 7.5, + "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P" } ] } diff --git a/2025/3xxx/CVE-2025-3425.json b/2025/3xxx/CVE-2025-3425.json index 99be80ce5a7..454251a64b3 100644 --- a/2025/3xxx/CVE-2025-3425.json +++ b/2025/3xxx/CVE-2025-3425.json @@ -1,18 +1,80 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-3425", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "productsecurity@philips.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the deserialization vulnerability. After analyzing the configuration files, we observed that the server had set the TypeFilterLevel to Full which is dangerous as it can potentially lead to remote code execution using deserialization. This issue affects IntelliSpace Portal: 12 and prior." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-502 Deserialization of Untrusted Data", + "cweId": "CWE-502" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Philips", + "product": { + "product_data": [ + { + "product_name": "IntelliSpace Portal", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "12 and prior" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.cve.org/CVERecord?id=CVE-2025-3425", + "refsource": "MISC", + "name": "https://www.cve.org/CVERecord?id=CVE-2025-3425" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "EXTERNAL" + }, + "credits": [ + { + "lang": "en", + "value": "Victor A Morales" + }, + { + "lang": "en", + "value": "Omar A Crespo" + } + ] } \ No newline at end of file diff --git a/2025/3xxx/CVE-2025-3426.json b/2025/3xxx/CVE-2025-3426.json new file mode 100644 index 00000000000..98adaaeb528 --- /dev/null +++ b/2025/3xxx/CVE-2025-3426.json @@ -0,0 +1,91 @@ +{ + "data_version": "4.0", + "data_type": "CVE", + "data_format": "MITRE", + "CVE_data_meta": { + "ID": "CVE-2025-3426", + "ASSIGNER": "productsecurity@philips.com", + "STATE": "PUBLIC" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "We observed that Intellispace Portal binaries doesn\u2019t have any protection mechanisms to prevent reverse engineering. Specifically, the app\u2019s code is not obfuscated, and no measures are in place to protect against decompilation, disassembly, or debugging. As a result, attackers can reverse-engineer the application to gain insights into its internal workings, which can potentially lead to the discovery of sensitive information, business logic flaws, and other vulnerabilities.\nUtilizing this flaw, the attacker was able to identify the Hardcoded credentials from PortalUsersDatabase.dll, which contains .NET remoting definition. Inside the namespace PortalUsersDatabase, the class Users contains the functions CreateAdmin and CreateService that are used to initialize accounts in the Portal service. Both CreateAdmin and CreateService functions contain a hardcoded encrypted password along with its respective salt that are set with the function SetInitialPasswordAndSalt.\nThis issue affects IntelliSpace Portal: 12 and prior; Advanced Visualization Workspace: 15." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-798 Use of Hard-coded Credentials", + "cweId": "CWE-798" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Philips", + "product": { + "product_data": [ + { + "product_name": "IntelliSpace Portal", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "12 and prior" + } + ] + } + }, + { + "product_name": "Advanced Visualization Workspace", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "15" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.cve.org/CVERecord?id=CVE-2025-3426", + "refsource": "MISC", + "name": "https://www.cve.org/CVERecord?id=CVE-2025-3426" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "EXTERNAL" + }, + "credits": [ + { + "lang": "en", + "value": "Victor A Morales" + }, + { + "lang": "en", + "value": "Omar A Crespo" + } + ] +} \ No newline at end of file