mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-06-07 21:47:16 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
f66f37a8a9
commit
ea93be2064
@ -1,18 +1,132 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-0073",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "arm-security@arm.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 before r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 before r54p0."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-416 Use After Free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Arm Ltd",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Valhall GPU Kernel Driver",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r54p0",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThan": "r54p0",
|
||||
"status": "affected",
|
||||
"version": "r53p0",
|
||||
"versionType": "patch"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Arm 5th Gen GPU Architecture Kernel Driver",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r54p0",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThan": "r54p0",
|
||||
"status": "affected",
|
||||
"version": "r53p0",
|
||||
"versionType": "patch"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://developer.arm.com/documentation/110466/latest/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://developer.arm.com/documentation/110466/latest/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "This issue has been fixed in the following versions: Valhall GPU Kernel Driver r54p0; Arm 5th Gen GPU Architecture Kernel Driver r54p0. Arm recommends that affected users upgrade to the latest applicable version to protect against this issue.<br>"
|
||||
}
|
||||
],
|
||||
"value": "This issue has been fixed in the following versions: Valhall GPU Kernel Driver r54p0; Arm 5th Gen GPU Architecture Kernel Driver r54p0. Arm recommends that affected users upgrade to the latest applicable version to protect against this issue."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Man Yue Mo of GitHub Security Lab"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,18 +1,195 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-0819",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "arm-security@arm.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r44p0 through r49p3, from r50p0 through r51p0; Valhall GPU Kernel Driver: from r44p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r44p0 through r49p3, from r50p0 through r54p0."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-416 Use After Free",
|
||||
"cweId": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Arm Ltd",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Bifrost GPU Kernel Driver",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r49p4",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "r49p3",
|
||||
"status": "affected",
|
||||
"version": "r44p0",
|
||||
"versionType": "patch"
|
||||
},
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r54p1",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "r51p0",
|
||||
"status": "affected",
|
||||
"version": "r50p0",
|
||||
"versionType": "patch"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Valhall GPU Kernel Driver",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r49p4",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "r49p3",
|
||||
"status": "affected",
|
||||
"version": "r44p0",
|
||||
"versionType": "patch"
|
||||
},
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r54p1",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "r54p0",
|
||||
"status": "affected",
|
||||
"version": "r50p0",
|
||||
"versionType": "patch"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Arm 5th Gen GPU Architecture Kernel Driver",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r49p4",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "r49p3",
|
||||
"status": "affected",
|
||||
"version": "r44p0",
|
||||
"versionType": "patch"
|
||||
},
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r54p1",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "r54p0",
|
||||
"status": "affected",
|
||||
"version": "r50p0",
|
||||
"versionType": "patch"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://developer.arm.com/documentation/110466/latest/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://developer.arm.com/documentation/110466/latest/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "This issue has been fixed in the following versions: Bifrost GPU Kernel Driver r49p4, r54p1; Valhall GPU Kernel Driver r49p4, r54p1; Arm 5th Gen GPU Architecture Kernel Driver r49p4, r54p1. Arm recommends that affected users upgrade to the latest applicable version at Mali Driver Downloads to protect against this issue.<br>"
|
||||
}
|
||||
],
|
||||
"value": "This issue has been fixed in the following versions: Bifrost GPU Kernel Driver r49p4, r54p1; Valhall GPU Kernel Driver r49p4, r54p1; Arm 5th Gen GPU Architecture Kernel Driver r49p4, r54p1. Arm recommends that affected users upgrade to the latest applicable version at Mali Driver Downloads to protect against this issue."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Jaeyoung Chung, Juhee Kim of the CompSec Lab at Seoul National University"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,18 +1,189 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-1246",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "arm-security@arm.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access outside of buffer bounds.This issue affects Bifrost GPU Userspace Driver: from r18p0 through r49p3, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r28p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r49p3, from r50p0 through r54p0."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
|
||||
"cweId": "CWE-119"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Arm Ltd",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Bifrost GPU Userspace Driver",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r49p4",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "r49p3",
|
||||
"status": "affected",
|
||||
"version": "r18p0",
|
||||
"versionType": "patch"
|
||||
},
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r54p1",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "r51p0",
|
||||
"status": "affected",
|
||||
"version": "r50p0",
|
||||
"versionType": "patch"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Valhall GPU Userspace Driver",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r49p4",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "r49p3",
|
||||
"status": "affected",
|
||||
"version": "r28p0",
|
||||
"versionType": "patch"
|
||||
},
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r54p1",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "r54p0",
|
||||
"status": "affected",
|
||||
"version": "r50p0",
|
||||
"versionType": "patch"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Arm 5th Gen GPU Architecture Userspace Driver",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r49p4",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "r49p3",
|
||||
"status": "affected",
|
||||
"version": "r41p0",
|
||||
"versionType": "patch"
|
||||
},
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "r54p1",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "r54p0",
|
||||
"status": "affected",
|
||||
"version": "r50p0",
|
||||
"versionType": "patch"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://developer.arm.com/documentation/110466/latest/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://developer.arm.com/documentation/110466/latest/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "This issue has been fixed in the following versions: Bifrost GPU Userspace Driver r49p4, r54p1; Valhall GPU Userspace Driver r49p4, r54p1; Arm 5th Gen GPU Architecture Userspace Driver r49p4, r54p1. Arm recommends that affected users upgrade to the latest applicable version to protect against this issue.<br>"
|
||||
}
|
||||
],
|
||||
"value": "This issue has been fixed in the following versions: Bifrost GPU Userspace Driver r49p4, r54p1; Valhall GPU Userspace Driver r49p4, r54p1; Arm 5th Gen GPU Architecture Userspace Driver r49p4, r54p1. Arm recommends that affected users upgrade to the latest applicable version to protect against this issue."
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,18 +1,82 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-46807",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security@suse.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh and deny legitimate users service.This issue affects sslh before 2.2.4."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-770: Allocation of Resources Without Limits or Throttling",
|
||||
"cweId": "CWE-770"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "https://github.com/yrutschle/sslh/releases/tag/v2.2.4",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "sslh",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "?",
|
||||
"version_value": "2.2.4"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/yrutschle/sslh/releases/tag/v2.2.4",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/yrutschle/sslh/releases/tag/v2.2.4"
|
||||
},
|
||||
{
|
||||
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46807",
|
||||
"refsource": "MISC",
|
||||
"name": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46807"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Matthias Gerstner, SUSE"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,17 +1,90 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-47289",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "CE Phoenix is a free, open-source eCommerce platform. A stored cross-site scripting (XSS) vulnerability was discovered in CE Phoenix versions 1.0.9.9 through 1.1.0.2 where an attacker can inject malicious JavaScript into the testimonial description field. Once submitted, if the shop owner (admin) approves the testimonial, the script executes in the context of any user visiting the testimonial page. Because the session cookies are not marked with the `HttpOnly` flag, they can be exfiltrated by the attacker \u2014 potentially leading to account takeover. Version 1.1.0.3 fixes the issue."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag",
|
||||
"cweId": "CWE-1004"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "CE-PhoenixCart",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "PhoenixCart",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 1.0.9.7, < 1.1.0.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/CE-PhoenixCart/PhoenixCart/security/advisories/GHSA-98qq-m8qj-vvgj",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/CE-PhoenixCart/PhoenixCart/security/advisories/GHSA-98qq-m8qj-vvgj"
|
||||
},
|
||||
{
|
||||
"url": "https://drive.google.com/file/d/1uQAEjewSL9jWWu1UHe47tAnM7U4_x39g/view?usp=drive_link",
|
||||
"refsource": "MISC",
|
||||
"name": "https://drive.google.com/file/d/1uQAEjewSL9jWWu1UHe47tAnM7U4_x39g/view?usp=drive_link"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-98qq-m8qj-vvgj",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,18 +1,87 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-48494",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cross-site scripting vulnerability can be exploited by uploading a file with JavaScript code embedded in the filename. After upload and every time someone opens the upload list, the script is then parsed. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users using a version prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A possible workaround would be to disable end-to-end encryption."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
|
||||
"cweId": "CWE-79"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-87: Improper Neutralization of Alternate XSS Syntax",
|
||||
"cweId": "CWE-87"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Forceu",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Gokapi",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "< 2.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-95rc-wc32-gm53",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-95rc-wc32-gm53"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/Forceu/Gokapi/commit/343cc566cfd7f4efcd522c92371561d494aed6b0",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/Forceu/Gokapi/commit/343cc566cfd7f4efcd522c92371561d494aed6b0"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/Forceu/Gokapi/releases/tag/v2.0.0",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/Forceu/Gokapi/releases/tag/v2.0.0"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-95rc-wc32-gm53",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,82 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-48495",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, an authenticated user could inject JS into the API key overview, which would also be executed when another user clicks on his API tab. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users of versions prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A workaround would be to not open the API page if it is possible that another user might have injected code."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
|
||||
"cweId": "CWE-79"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-87: Improper Neutralization of Alternate XSS Syntax",
|
||||
"cweId": "CWE-87"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Forceu",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Gokapi",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "< 2.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-4xg4-54hm-9j77",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-4xg4-54hm-9j77"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/Forceu/Gokapi/commit/65ddbc68fbfdf1c80cadb477f4bcbb7f2c4fdbf8",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/Forceu/Gokapi/commit/65ddbc68fbfdf1c80cadb477f4bcbb7f2c4fdbf8"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-4xg4-54hm-9j77",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,17 +1,90 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-48955",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes. Version 1.50.8 fixes the issue."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-532: Insertion of Sensitive Information into Log File",
|
||||
"cweId": "CWE-532"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Erudika",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "para",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "< 1.50.8"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/Erudika/para/security/advisories/GHSA-v75g-77vf-6jjq",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/Erudika/para/security/advisories/GHSA-v75g-77vf-6jjq"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/Erudika/para/commit/1e8a89558542854bb0683ab234c4429ad93b0835",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/Erudika/para/commit/1e8a89558542854bb0683ab234c4429ad93b0835"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-v75g-77vf-6jjq",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.2,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,100 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-48957",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in Pull Request #1676 and is included in version 3.5.13. As a workaround, users can edit the `cmd_config.json` file to disable the dashboard feature as a temporary workaround. However, it is strongly recommended to upgrade to version v3.5.13 or later to fully resolve this issue."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-23: Relative Path Traversal",
|
||||
"cweId": "CWE-23"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "AstrBotDevs",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "AstrBot",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 3.4.4, < 3.5.13"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/AstrBotDevs/AstrBot/issues/1675",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/AstrBotDevs/AstrBot/issues/1675"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/AstrBotDevs/AstrBot/pull/1676",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/AstrBotDevs/AstrBot/pull/1676"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/AstrBotDevs/AstrBot/commit/cceadf222c46813c7f41115b40d371e7eb91e492",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/AstrBotDevs/AstrBot/commit/cceadf222c46813c7f41115b40d371e7eb91e492"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-cq37-g2qp-3c2p",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 7.5,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,95 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-48958",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication. Version 2.2.6 fixes the issue."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
|
||||
"cweId": "CWE-79"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "froxlor",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Froxlor",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "< 2.2.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/froxlor/Froxlor/security/advisories/GHSA-26xq-m8xw-6373",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/froxlor/Froxlor/security/advisories/GHSA-26xq-m8xw-6373"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/froxlor/Froxlor/commit/fde43f80600f1035e1e3d2297411b666d805549a",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/froxlor/Froxlor/commit/fde43f80600f1035e1e3d2297411b666d805549a"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/user-attachments/assets/86947633-3e7c-4e10-86cc-92e577761e8e",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/user-attachments/assets/86947633-3e7c-4e10-86cc-92e577761e8e"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-26xq-m8xw-6373",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 5.5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,18 +1,73 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-48990",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "NeKernal is a free and open-source operating system stack. Version 0.0.2 has a 1-byte heap overflow in `rt_copy_memory`, which unconditionally wrote a null terminator at `dst[len]`. When `len` equals the size of the destination buffer (256 bytes), that extra `'\\0'` write overruns the buffer by one byte. To avoid breaking existing callers or changing the public API, the patch in commit fb7b7f658327f659c6a6da1af151cb389c2ca4ee takes a minimal approach: it simply removes the overflow-causing line without adding bounds checks or altering the function signature."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-122: Heap-based Buffer Overflow",
|
||||
"cweId": "CWE-122"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "nekernel-org",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "nekernel",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "= 0.0.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/nekernel-org/nekernel/security/advisories/GHSA-jvvh-fp57-2p32",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/nekernel-org/nekernel/security/advisories/GHSA-jvvh-fp57-2p32"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/nekernel-org/nekernel/commit/fb7b7f658327f659c6a6da1af151cb389c2ca4ee",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/nekernel-org/nekernel/commit/fb7b7f658327f659c6a6da1af151cb389c2ca4ee"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-jvvh-fp57-2p32",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,17 +1,274 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-5442",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@vuldb.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function RP_pingGatewayByBBS of the file /goform/RP_pingGatewayByBBS. The manipulation of the argument ip/nm/gw leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
|
||||
},
|
||||
{
|
||||
"lang": "deu",
|
||||
"value": "Eine Schwachstelle wurde in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 entdeckt. Sie wurde als kritisch eingestuft. Es geht hierbei um die Funktion RP_pingGatewayByBBS der Datei /goform/RP_pingGatewayByBBS. Durch das Beeinflussen des Arguments ip/nm/gw mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "OS Command Injection",
|
||||
"cweId": "CWE-78"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Command Injection",
|
||||
"cweId": "CWE-77"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Linksys",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "RE6500",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.013.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.002"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.1.05.003"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.2.07.001"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "RE6250",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.013.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.002"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.1.05.003"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.2.07.001"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "RE6300",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.013.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.002"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.1.05.003"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.2.07.001"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "RE6350",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.013.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.002"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.1.05.003"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.2.07.001"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "RE7000",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.013.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.002"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.1.05.003"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.2.07.001"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "RE9000",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.013.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.002"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.1.05.003"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.2.07.001"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://vuldb.com/?id.310781",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?id.310781"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?ctiid.310781",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?ctiid.310781"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?submit.584364",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?submit.584364"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_5/5.md",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_5/5.md"
|
||||
},
|
||||
{
|
||||
"url": "https://www.linksys.com/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.linksys.com/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "pjqwudi (VulDB User)"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"baseScore": 6.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
{
|
||||
"version": "3.0",
|
||||
"baseScore": 6.3,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
{
|
||||
"version": "2.0",
|
||||
"baseScore": 6.5,
|
||||
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,274 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-5443",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@vuldb.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the function wirelessAdvancedHidden of the file /goform/wirelessAdvancedHidden. The manipulation of the argument ExtChSelector/24GSelector/5GSelector leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
|
||||
},
|
||||
{
|
||||
"lang": "deu",
|
||||
"value": "Es wurde eine Schwachstelle in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 gefunden. Sie wurde als kritisch eingestuft. Es geht dabei um die Funktion wirelessAdvancedHidden der Datei /goform/wirelessAdvancedHidden. Durch Beeinflussen des Arguments ExtChSelector/24GSelector/5GSelector mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "OS Command Injection",
|
||||
"cweId": "CWE-78"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Command Injection",
|
||||
"cweId": "CWE-77"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Linksys",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "RE6500",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.013.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.002"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.1.05.003"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.2.07.001"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "RE6250",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.013.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.002"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.1.05.003"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.2.07.001"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "RE6300",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.013.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.002"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.1.05.003"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.2.07.001"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "RE6350",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.013.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.002"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.1.05.003"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.2.07.001"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "RE7000",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.013.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.002"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.1.05.003"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.2.07.001"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "RE9000",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.013.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.001"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0.04.002"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.1.05.003"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.2.07.001"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://vuldb.com/?id.310782",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?id.310782"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?ctiid.310782",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?ctiid.310782"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?submit.584365",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?submit.584365"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_6/6.md",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_6/6.md"
|
||||
},
|
||||
{
|
||||
"url": "https://www.linksys.com/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.linksys.com/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "pjqwudi (VulDB User)"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"baseScore": 6.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
{
|
||||
"version": "3.0",
|
||||
"baseScore": 6.3,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
{
|
||||
"version": "2.0",
|
||||
"baseScore": 6.5,
|
||||
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
18
2025/5xxx/CVE-2025-5464.json
Normal file
18
2025/5xxx/CVE-2025-5464.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-5464",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2025/5xxx/CVE-2025-5465.json
Normal file
18
2025/5xxx/CVE-2025-5465.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-5465",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2025/5xxx/CVE-2025-5466.json
Normal file
18
2025/5xxx/CVE-2025-5466.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-5466",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user