From bc5015f85b4ef9c9f7419cff761f0385b438a657 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Thu, 29 May 2025 20:00:39 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2024/49xxx/CVE-2024-49350.json | 102 ++++++++++++++++++++++++++++++-- 2024/54xxx/CVE-2024-54952.json | 56 ++++++++++++++++-- 2025/2xxx/CVE-2025-2518.json | 97 ++++++++++++++++++++++++++++-- 2025/3xxx/CVE-2025-3050.json | 97 ++++++++++++++++++++++++++++-- 2025/46xxx/CVE-2025-46701.json | 79 +++++++++++++++++++++++-- 2025/47xxx/CVE-2025-47288.json | 81 +++++++++++++++++++++++-- 2025/47xxx/CVE-2025-47933.json | 93 +++++++++++++++++++++++++++-- 2025/4xxx/CVE-2025-4967.json | 82 ++++++++++++++++++++++++-- 2025/5xxx/CVE-2025-5325.json | 104 +++++++++++++++++++++++++++++++-- 9 files changed, 752 insertions(+), 39 deletions(-) diff --git a/2024/49xxx/CVE-2024-49350.json b/2024/49xxx/CVE-2024-49350.json index 86dcf96de33..45e4da75385 100644 --- a/2024/49xxx/CVE-2024-49350.json +++ b/2024/49xxx/CVE-2024-49350.json @@ -1,17 +1,111 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-49350", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@us.ibm.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-121 Stack-based Buffer Overflow", + "cweId": "CWE-121" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "IBM", + "product": { + "product_data": [ + { + "product_name": "Db2 for Linux, UNIX and Windows", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "11.5.0", + "version_value": "11.5.9" + }, + { + "version_affected": "<=", + "version_name": "12.1.0", + "version_value": "12.1.1" + }, + { + "version_affected": "<=", + "version_name": "11.1.0", + "version_value": "11.1.4.7" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.ibm.com/support/pages/node/7235069", + "refsource": "MISC", + "name": "https://www.ibm.com/support/pages/node/7235069" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Customers running any vulnerable affected level of an affected Program, V11.1, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent affected level for each impacted release: V11.1.4 FP7, V11.5.9, and V12.1.1. They can be applied to any affected mod pack level of the appropriate release to remediate this vulnerability." + } + ], + "value": "Customers running any vulnerable affected level of an affected Program, V11.1, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent affected level for each impacted release: V11.1.4 FP7, V11.5.9, and V12.1.1. They can be applied to any affected mod pack level of the appropriate release to remediate this vulnerability." + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 6.5, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", + "version": "3.1" } ] } diff --git a/2024/54xxx/CVE-2024-54952.json b/2024/54xxx/CVE-2024-54952.json index 2788a0e1727..425a7a66d38 100644 --- a/2024/54xxx/CVE-2024-54952.json +++ b/2024/54xxx/CVE-2024-54952.json @@ -1,17 +1,61 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2024-54952", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2024-54952", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers can exploit this issue by sending specially crafted packets, triggering a null pointer dereference. This leads to a Remote Denial of Service (DoS), rendering the SMB service unavailable." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/noobone123/RouterOS-issues/blob/main/README.md", + "refsource": "MISC", + "name": "https://github.com/noobone123/RouterOS-issues/blob/main/README.md" } ] } diff --git a/2025/2xxx/CVE-2025-2518.json b/2025/2xxx/CVE-2025-2518.json index ebe67473589..fb57bbce237 100644 --- a/2025/2xxx/CVE-2025-2518.json +++ b/2025/2xxx/CVE-2025-2518.json @@ -1,17 +1,106 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-2518", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@us.ibm.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 \n\nis vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-789 Uncontrolled Memory Allocation", + "cweId": "CWE-789" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "IBM", + "product": { + "product_data": [ + { + "product_name": "Db2 for Linux, UNIX and Windows", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "11.5.0", + "version_value": "11.5.9" + }, + { + "version_affected": "<=", + "version_name": "12.1.0", + "version_value": "12.1.1" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.ibm.com/support/pages/node/7235072", + "refsource": "MISC", + "name": "https://www.ibm.com/support/pages/node/7235072" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent affected level for each impacted release: V11.5.9, and V12.1.1. They can be applied to any affected mod pack level of the appropriate release to remediate this vulnerability.
" + } + ], + "value": "Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent affected level for each impacted release: V11.5.9, and V12.1.1. They can be applied to any affected mod pack level of the appropriate release to remediate this vulnerability." + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 5.3, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", + "version": "3.1" } ] } diff --git a/2025/3xxx/CVE-2025-3050.json b/2025/3xxx/CVE-2025-3050.json index 027ba939197..a58ba7c03f8 100644 --- a/2025/3xxx/CVE-2025-3050.json +++ b/2025/3xxx/CVE-2025-3050.json @@ -1,17 +1,106 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-3050", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@us.ibm.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when using Q replication due to the improper allocation of CPU resources." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-770 Allocation of Resources Without Limits or Throttling", + "cweId": "CWE-770" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "IBM", + "product": { + "product_data": [ + { + "product_name": "Db2 for Linux, UNIX and Windows", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "11.5.0", + "version_value": "11.5.9" + }, + { + "version_affected": "<=", + "version_name": "12.1.0", + "version_value": "12.1.1" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.ibm.com/support/pages/node/7235073", + "refsource": "MISC", + "name": "https://www.ibm.com/support/pages/node/7235073" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent affected level for each impacted release: V11.5.9, and V12.1.1. They can be applied to any affected mod pack level of the appropriate release to remediate this vulnerability.
" + } + ], + "value": "Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent affected level for each impacted release: V11.5.9, and V12.1.1. They can be applied to any affected mod pack level of the appropriate release to remediate this vulnerability." + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 5.3, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", + "version": "3.1" } ] } diff --git a/2025/46xxx/CVE-2025-46701.json b/2025/46xxx/CVE-2025-46701.json index 95fe433f5a6..c16ace07d5f 100644 --- a/2025/46xxx/CVE-2025-46701.json +++ b/2025/46xxx/CVE-2025-46701.json @@ -1,18 +1,87 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-46701", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@apache.org", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.\n\nUsers are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-178 Improper Handling of Case Sensitivity", + "cweId": "CWE-178" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Apache Software Foundation", + "product": { + "product_data": [ + { + "product_name": "Apache Tomcat", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "11.0.0-M1", + "version_value": "11.0.6" + }, + { + "version_affected": "<=", + "version_name": "10.1.0-M1", + "version_value": "10.1.40" + }, + { + "version_affected": "<=", + "version_name": "9.0.0.M1", + "version_value": "9.0.104" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j", + "refsource": "MISC", + "name": "https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "EXTERNAL" + }, + "credits": [ + { + "lang": "en", + "value": "Greg K (https://github.com/gregk4sec)" + } + ] } \ No newline at end of file diff --git a/2025/47xxx/CVE-2025-47288.json b/2025/47xxx/CVE-2025-47288.json index fe9e737862b..51cf62bd99f 100644 --- a/2025/47xxx/CVE-2025-47288.json +++ b/2025/47xxx/CVE-2025-47288.json @@ -1,17 +1,90 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-47288", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security-advisories@github.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic that was tied to a private group then the group members could be shown to non-group members. This issue has been patched in version 0.1.1. A workaround involves moving any policy topics with private groups to restricted categories." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", + "cweId": "CWE-200" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "discourse", + "product": { + "product_data": [ + { + "product_name": "discourse-policy", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "< 0.1.1" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/discourse/discourse-policy/security/advisories/GHSA-jc5r-rm2j-mh4x", + "refsource": "MISC", + "name": "https://github.com/discourse/discourse-policy/security/advisories/GHSA-jc5r-rm2j-mh4x" + }, + { + "url": "https://github.com/discourse/discourse-policy/commit/6b4390fe486408cc86ccea6b091406cfac6c5b8f", + "refsource": "MISC", + "name": "https://github.com/discourse/discourse-policy/commit/6b4390fe486408cc86ccea6b091406cfac6c5b8f" + } + ] + }, + "source": { + "advisory": "GHSA-jc5r-rm2j-mh4x", + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 3.5, + "baseSeverity": "LOW", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", + "version": "3.1" } ] } diff --git a/2025/47xxx/CVE-2025-47933.json b/2025/47xxx/CVE-2025-47933.json index 7da4b33b8ca..8c3be9e02c0 100644 --- a/2025/47xxx/CVE-2025-47933.json +++ b/2025/47xxx/CVE-2025-47933.json @@ -1,17 +1,102 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-47933", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security-advisories@github.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "argoproj", + "product": { + "product_data": [ + { + "product_name": "argo-cd", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": ">= 1.2.0-rc1, <= 1.8.7" + }, + { + "version_affected": "=", + "version_value": ">= 2.0.0-rc3, < 2.13.8" + }, + { + "version_affected": "=", + "version_value": ">= 2.14.0-rc1, < 2.14.13" + }, + { + "version_affected": "=", + "version_value": ">= 3.0.0-rc1, < 3.0.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2hj5-g64g-fp6p", + "refsource": "MISC", + "name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2hj5-g64g-fp6p" + }, + { + "url": "https://github.com/argoproj/argo-cd/commit/a5b4041a79c54bc7b3d090805d070bcdb9a9e4d1", + "refsource": "MISC", + "name": "https://github.com/argoproj/argo-cd/commit/a5b4041a79c54bc7b3d090805d070bcdb9a9e4d1" + } + ] + }, + "source": { + "advisory": "GHSA-2hj5-g64g-fp6p", + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "CHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", + "version": "3.1" } ] } diff --git a/2025/4xxx/CVE-2025-4967.json b/2025/4xxx/CVE-2025-4967.json index 2738c1ca004..65ba401a827 100644 --- a/2025/4xxx/CVE-2025-4967.json +++ b/2025/4xxx/CVE-2025-4967.json @@ -1,17 +1,91 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-4967", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@esri.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal\u2019s SSRF protections." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-918 Server-Side Request Forgery (SSRF)SSRF", + "cweId": "CWE-918" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Esri", + "product": { + "product_data": [ + { + "product_name": "Portal for ArcGIS", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "11.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-2-patch", + "refsource": "MISC", + "name": "https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-2-patch" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "defect": [ + "BUG-000176212" + ], + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", + "version": "3.1" } ] } diff --git a/2025/5xxx/CVE-2025-5325.json b/2025/5xxx/CVE-2025-5325.json index 8fb247e82a7..16be8c32ffc 100644 --- a/2025/5xxx/CVE-2025-5325.json +++ b/2025/5xxx/CVE-2025-5325.json @@ -1,17 +1,113 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2025-5325", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability has been found in zhilink \u667a\u4e92\u8054(\u6df1\u5733)\u79d1\u6280\u6709\u9650\u516c\u53f8 ADP Application Developer Platform \u5e94\u7528\u5f00\u53d1\u8005\u5e73\u53f0 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /adpweb/a/ica/api/service/rfa/testService. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "deu", + "value": "In zhilink \u667a\u4e92\u8054(\u6df1\u5733)\u79d1\u6280\u6709\u9650\u516c\u53f8 ADP Application Developer Platform \u5e94\u7528\u5f00\u53d1\u8005\u5e73\u53f0 1.0.0 wurde eine Schwachstelle gefunden. Sie wurde als kritisch eingestuft. Es geht um eine nicht n\u00e4her bekannte Funktion der Datei /adpweb/a/ica/api/service/rfa/testService. Durch das Beeinflussen mit unbekannten Daten kann eine improper neutralization of special elements used in a template engine-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Improper Neutralization of Special Elements Used in a Template Engine", + "cweId": "CWE-1336" + } + ] + }, + { + "description": [ + { + "lang": "eng", + "value": "Incomplete Filtering of Special Elements", + "cweId": "CWE-791" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "zhilink \u667a\u4e92\u8054(\u6df1\u5733)\u79d1\u6280\u6709\u9650\u516c\u53f8", + "product": { + "product_data": [ + { + "product_name": "ADP Application Developer Platform \u5e94\u7528\u5f00\u53d1\u8005\u5e73\u53f0", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "1.0.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.310495", + "refsource": "MISC", + "name": "https://vuldb.com/?id.310495" + }, + { + "url": "https://vuldb.com/?ctiid.310495", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.310495" + }, + { + "url": "https://vuldb.com/?submit.581275", + "refsource": "MISC", + "name": "https://vuldb.com/?submit.581275" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Id3al (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 6.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 6.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 6.5, + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P" } ] }