admin/nvd-json-data-feeds
1
0
Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2025-06-19 17:31:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2025-04-26T06:00:20.201966+00:00

Browse Source
This commit is contained in:
cad-safe-bot 2025-04-26 06:03:58 +00:00
parent 3fd94d4b86
commit 240125a50b
5 changed files with 141 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
CVE-2024/CVE-2024-138xx/CVE-2024-13808.json Normal file
View File

@ -0,0 +1,60 @@
{
"id": "CVE-2024-13808",
"sourceIdentifier": "security@wordfence.com",
"published": "2025-04-26T05:15:51.317",
"lastModified": "2025-04-26T05:15:51.317",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.9 via the custom PHP widget. This is due to their only being client side controls when determining who can access the widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"references": [
{
"url": "https://elementor.wpxpro.com",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0833e55f-22aa-44c9-aff6-1f3b74016e4c?source=cve",
"source": "security@wordfence.com"
}
]
}

4
CVE-2024/CVE-2024-65xx/CVE-2024-6538.json
View File

@ -2,13 +2,13 @@
"id": "CVE-2024-6538",
"sourceIdentifier": "secalert@redhat.com",
"published": "2024-11-25T07:15:06.187",
"lastModified": "2024-11-25T07:15:06.187",
"lastModified": "2025-04-26T04:15:29.603",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system.\nThe /api/dev-console/proxy/internet endpoint on the OpenShit Console allows authenticated users to have the console's pod perform arbitrary and fully controlled HTTP(s) requests. The full response to these requests is returned by the endpoint.\nWhile the name of this endpoint suggests the requests are only bound to the internet, no such checks are in place. An authenticated user can therefore ask the console to perform arbitrary HTTP requests from outside the cluster to a service inside the cluster."
"value": "A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system.\nThe /api/dev-console/proxy/internet endpoint on the OpenShift Console allows authenticated users to have the console's pod perform arbitrary and fully controlled HTTP(s) requests. The full response to these requests is returned by the endpoint.\nWhile the name of this endpoint suggests the requests are only bound to the internet, no such checks are in place. An authenticated user can therefore ask the console to perform arbitrary HTTP requests from outside the cluster to a service inside the cluster."
},
{
"lang": "es",

68
CVE-2025/CVE-2025-28xx/CVE-2025-2801.json Normal file
View File

@ -0,0 +1,68 @@
{
"id": "CVE-2025-2801",
"sourceIdentifier": "security@wordfence.com",
"published": "2025-04-26T04:15:30.920",
"lastModified": "2025-04-26T04:15:30.920",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/abcsubmit/tags/1.2.4/abcsubmit.php#L86",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/abcsubmit/tags/1.2.4/abcsubmit.php#L88",
"source": "security@wordfence.com"
},
{
"url": "https://wordpress.org/plugins/abcsubmit/#developers",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e45afda4-447a-4d95-90cb-9731b398a009?source=cve",
"source": "security@wordfence.com"
}
]
}

12
README.md
View File

@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2025-04-26T02:00:19.510568+00:00
2025-04-26T06:00:20.201966+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2025-04-26T01:15:41.930000+00:00
2025-04-26T05:15:51.317000+00:00
```
### Last Data Feed Release
@ -33,20 +33,22 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
291466
291468
```
### CVEs added in the last Commit
Recently added CVEs: `0`
Recently added CVEs: `2`
- [CVE-2024-13808](CVE-2024/CVE-2024-138xx/CVE-2024-13808.json) (`2025-04-26T05:15:51.317`)
- [CVE-2025-2801](CVE-2025/CVE-2025-28xx/CVE-2025-2801.json) (`2025-04-26T04:15:30.920`)
### CVEs modified in the last Commit
Recently modified CVEs: `1`
- [CVE-2025-31324](CVE-2025/CVE-2025-313xx/CVE-2025-31324.json) (`2025-04-26T01:15:41.930`)
- [CVE-2024-6538](CVE-2024/CVE-2024-65xx/CVE-2024-6538.json) (`2025-04-26T04:15:29.603`)
## Download and Usage

6
_state.csv
View File

@ -248332,6 +248332,7 @@ CVE-2024-13803,0,0,4e24800ba40fc256cc0289d1f872baa86fef30a57808a0b8f614599093938
CVE-2024-13804,0,0,cbe6f9983ceb9bb355e7ac1cc12ef34c0668c82e27d3ad7f433cbf589c97824b,2025-04-01T20:26:30.593000
CVE-2024-13805,0,0,ab23ddffd79c9236654dca87d416c22cef2f181f71a6522374ad6bbab1e39bf2,2025-03-07T10:15:16.123000
CVE-2024-13806,0,0,2b103acb686ba11654b3e2c5ab41948ab81fbeb9ed340b778f561b48dfe3cc2f,2025-03-01T08:15:33.653000
CVE-2024-13808,1,1,d2e466ba1a89484b4f77f7da1ad68c9bfb7ea58c99354b2f668dcbdc1800e41e,2025-04-26T05:15:51.317000
CVE-2024-13809,0,0,0560f3b13a50d69c775a261a59e91c9ab0b720365e711ebd048429107113c32d,2025-03-05T10:15:17.313000
CVE-2024-1381,0,0,029377302d4050442312d0ea5700149ec4187470e4ad3d8cfad55037f8e5ed9f,2025-04-01T13:39:45.360000
CVE-2024-13810,0,0,fdf2d49dfa34debf8ee34b4921f174214e4829a57323b43cd52f342f23da5598,2025-03-05T10:15:17.503000
@ -278192,7 +278193,7 @@ CVE-2024-6533,0,0,46cc3e18f97fea63af187d8ee8a858656681df510db22100693a4acc025acf
CVE-2024-6534,0,0,fee5cbdaffddfb85a58c5c6ac217194b7470a5751dc745f2394460e6da4103af,2024-08-19T18:17:15.110000
CVE-2024-6535,0,0,44388289212b949983bbcb08fc4f387d14a7864b80be8ec8b5ccdce879cce735,2024-11-21T09:49:49.560000
CVE-2024-6536,0,0,7d70c9cba7e8708c505e036090d6fe133ada37c87b1ad8d8ecddea844c9eaa67,2024-11-21T09:49:50.537000
CVE-2024-6538,0,0,5f46cf9ed38ec21619b659591a19e36631f718f4cc9be3859a98a9796ee74cef,2024-11-25T07:15:06.187000
CVE-2024-6538,0,1,0bc470b1ac0c13495ad47134f6a2068df482787c4ca3e603e87d397395bcfe74,2025-04-26T04:15:29.603000
CVE-2024-6539,0,0,488f82b4dd195018a4571a7b41599ab86771c19553aea6769341658d3043c227,2024-11-21T09:49:50.707000
CVE-2024-6540,0,0,f3ea6a455e292a17968899748da95526cfa3d10fdcac7853f32fce07f60e60be,2024-11-21T09:49:50.857000
CVE-2024-6542,0,0,95c08c38ec0cfe53af1e3f2fc6b95f2c5e43a181678f8155f2d77a836dccc44c,2024-11-21T09:49:50.997000
@ -288067,6 +288068,7 @@ CVE-2025-2797,0,0,b1486c99f88bb0fe24ee44879fb68daede55b0ca436e040e01e9162820f0ca
CVE-2025-2798,0,0,ce50f1abf598f0e20dbb0b231565f286c9fd88d139aecf5e428c88b471d2c0d4,2025-04-07T14:18:15.560000
CVE-2025-27980,0,0,4dbd0443ffa6d0dbb8895cd077aff5d3275d8e79c32cedddf5b6571bcf5ad131,2025-04-15T21:15:55.583000
CVE-2025-28009,0,0,a53f54ff1cb907c68aed417d9d3fb82ce6e4849595f09833f1f065fa722c8f58,2025-04-23T18:53:10.863000
CVE-2025-2801,1,1,695b13471fc92063c617c4619b5201abc0604a0f70e3a4fa86fc7a08bed8b9eb,2025-04-26T04:15:30.920000
CVE-2025-28010,0,0,716afcbc5cebfe3c684dbf7aa12e99a30e3cb54526d7e93ef8e97f615752b08f,2025-04-03T16:42:46.520000
CVE-2025-28011,0,0,fdcb5591ea26e059e8d35048712169c6e42fd9f817189e1097ee50f0c5ccdc59,2025-03-28T20:00:36.220000
CVE-2025-28015,0,0,631137508e8a20a86b77040d3a1f398272eddb26c2d8f5274ce598561c73146c,2025-03-28T19:49:16.520000
@ -289449,7 +289451,7 @@ CVE-2025-31286,0,0,e856201c9b42834f1c9528734a2606281893fc23418757a05099912d18c27
CVE-2025-3129,0,0,9ce9125356a6ba22d5c34f89147622c417a2440c2d1cce155406586438a1f6de,2025-04-15T15:16:09.733000
CVE-2025-3130,0,0,2abf43bb001196273147b6a27c742bbd16b675243051ab2ef36e53893d26e0d3,2025-04-07T14:18:34.453000
CVE-2025-3131,0,0,22058460edb80eeb28e47627ce19a90708c04371cfdf5beafe6e1efa2f6db14c,2025-04-22T16:16:30.543000
CVE-2025-31324,0,1,99a87f47f19ea3b20a3dcf801896cc4bfc4c6602cf625fc7d95f6b6cd010c29b,2025-04-26T01:15:41.930000
CVE-2025-31324,0,0,99a87f47f19ea3b20a3dcf801896cc4bfc4c6602cf625fc7d95f6b6cd010c29b,2025-04-26T01:15:41.930000
CVE-2025-31327,0,0,32f90adc396c5de5b649e8fa5cbb5b70c97a786ce6ce173df87cdac30806552e,2025-04-23T14:08:13.383000
CVE-2025-31328,0,0,7562727b37bc696206e3437191848ea7fd9fb71483caff96e2687c6513ba8732,2025-04-23T14:08:13.383000
CVE-2025-31330,0,0,9b648c9ab2cbfab0d4ac3a100d1bd1b8fecdcaefd29ce618613bbd2f9e42ddfd,2025-04-08T18:13:53.347000

Can't render this file because it is too large.