diff --git a/2025/3xxx/CVE-2025-3986.json b/2025/3xxx/CVE-2025-3986.json index 4c92d4bf8d7..08fc854b5a0 100644 --- a/2025/3xxx/CVE-2025-3986.json +++ b/2025/3xxx/CVE-2025-3986.json @@ -1,17 +1,118 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-3986", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability was found in Apereo CAS 5.2.6. It has been declared as problematic. This vulnerability affects unknown code of the file cas-5.2.6\\core\\cas-server-core-configuration-metadata-repository\\src\\main\\java\\org\\apereo\\cas\\metadata\\rest\\CasConfigurationMetadataServerController.java. The manipulation of the argument Name leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "deu", + "value": "In Apereo CAS 5.2.6 wurde eine Schwachstelle ausgemacht. Sie wurde als problematisch eingestuft. Betroffen ist eine unbekannte Verarbeitung der Datei cas-5.2.6\\core\\cas-server-core-configuration-metadata-repository\\src\\main\\java\\org\\apereo\\cas\\metadata\\rest\\CasConfigurationMetadataServerController.java. Mittels dem Manipulieren des Arguments Name mit unbekannten Daten kann eine inefficient regular expression complexity-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Inefficient Regular Expression Complexity", + "cweId": "CWE-1333" + } + ] + }, + { + "description": [ + { + "lang": "eng", + "value": "Resource Consumption", + "cweId": "CWE-400" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Apereo", + "product": { + "product_data": [ + { + "product_name": "CAS", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "5.2.6" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.306322", + "refsource": "MISC", + "name": "https://vuldb.com/?id.306322" + }, + { + "url": "https://vuldb.com/?ctiid.306322", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.306322" + }, + { + "url": "https://vuldb.com/?submit.557473", + "refsource": "MISC", + "name": "https://vuldb.com/?submit.557473" + }, + { + "url": "https://wx.mail.qq.com/s?k=rk-m8GwRMVMcOjBY1a", + "refsource": "MISC", + "name": "https://wx.mail.qq.com/s?k=rk-m8GwRMVMcOjBY1a" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "caichaoxiong (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 4.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 4.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 4, + "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P" } ] } diff --git a/2025/3xxx/CVE-2025-3987.json b/2025/3xxx/CVE-2025-3987.json index ca072fb0049..9bcd1d44ca5 100644 --- a/2025/3xxx/CVE-2025-3987.json +++ b/2025/3xxx/CVE-2025-3987.json @@ -1,17 +1,123 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-3987", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used." + }, + { + "lang": "deu", + "value": "Eine Schwachstelle wurde in TOTOLINK N150RT 3.4.0-B20190525 ausgemacht. Sie wurde als kritisch eingestuft. Betroffen davon ist ein unbekannter Prozess der Datei /boafrm/formWsc. Mittels Manipulieren des Arguments localPin mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Command Injection", + "cweId": "CWE-77" + } + ] + }, + { + "description": [ + { + "lang": "eng", + "value": "Injection", + "cweId": "CWE-74" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "TOTOLINK", + "product": { + "product_data": [ + { + "product_name": "N150RT", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "3.4.0-B20190525" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.306323", + "refsource": "MISC", + "name": "https://vuldb.com/?id.306323" + }, + { + "url": "https://vuldb.com/?ctiid.306323", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.306323" + }, + { + "url": "https://vuldb.com/?submit.557938", + "refsource": "MISC", + "name": "https://vuldb.com/?submit.557938" + }, + { + "url": "https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/RCE_formWsc", + "refsource": "MISC", + "name": "https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/RCE_formWsc" + }, + { + "url": "https://www.totolink.net/", + "refsource": "MISC", + "name": "https://www.totolink.net/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "lcyf-fizz (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 6.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 6.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 6.5, + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P" } ] } diff --git a/2025/46xxx/CVE-2025-46689.json b/2025/46xxx/CVE-2025-46689.json new file mode 100644 index 00000000000..48f89648fc9 --- /dev/null +++ b/2025/46xxx/CVE-2025-46689.json @@ -0,0 +1,72 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2025-46689", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Ververica Platform 2.14.0 contain an Reflected XSS vulnerability via a namespaces/default/formats URI." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/ververica/ververica-platform-playground", + "refsource": "MISC", + "name": "https://github.com/ververica/ververica-platform-playground" + }, + { + "url": "https://github.com/gozan10/cve/issues/17", + "refsource": "MISC", + "name": "https://github.com/gozan10/cve/issues/17" + }, + { + "url": "https://www.ververica.com/", + "refsource": "MISC", + "name": "https://www.ververica.com/" + } + ] + } +} \ No newline at end of file diff --git a/2025/46xxx/CVE-2025-46690.json b/2025/46xxx/CVE-2025-46690.json new file mode 100644 index 00000000000..f949d64bd40 --- /dev/null +++ b/2025/46xxx/CVE-2025-46690.json @@ -0,0 +1,72 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2025-46690", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats request." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/ververica/ververica-platform-playground", + "refsource": "MISC", + "name": "https://github.com/ververica/ververica-platform-playground" + }, + { + "url": "https://www.ververica.com", + "refsource": "MISC", + "name": "https://www.ververica.com" + }, + { + "url": "https://github.com/gozan10/cve/issues/18", + "refsource": "MISC", + "name": "https://github.com/gozan10/cve/issues/18" + } + ] + } +} \ No newline at end of file