diff --git a/CVE-2010/CVE-2010-100xx/CVE-2010-10012.json b/CVE-2010/CVE-2010-100xx/CVE-2010-10012.json index 5ccfd3cd562..472fcd02fcb 100644 --- a/CVE-2010/CVE-2010-100xx/CVE-2010-10012.json +++ b/CVE-2010/CVE-2010-100xx/CVE-2010-10012.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A path traversal vulnerability exists in httpdasm version 0.92, a lightweight Windows HTTP server, that allows unauthenticated attackers to read arbitrary files on the host system. By sending a specially crafted GET request containing a sequence of URL-encoded backslashes\u00a0and directory traversal patterns, an attacker can escape the web root and access sensitive files outside of the intended directory." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de path traversal en httpdasm versi\u00f3n 0.92, un servidor HTTP ligero de Windows, que permite a atacantes no autenticados leer archivos arbitrarios en el sistema host. Al enviar una solicitud GET especialmente manipulada que contiene una secuencia de barras invertidas codificadas en URL y patrones de directory traversal, un atacante puede escapar de la root web y acceder a archivos confidenciales fuera del directorio de destino." } ], "metrics": { diff --git a/CVE-2011/CVE-2011-100xx/CVE-2011-10008.json b/CVE-2011/CVE-2011-100xx/CVE-2011-10008.json index f5d55c56b06..1a1cc823a78 100644 --- a/CVE-2011/CVE-2011-100xx/CVE-2011-10008.json +++ b/CVE-2011/CVE-2011-100xx/CVE-2011-10008.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A stack-based buffer overflow vulnerability exists in MPlayer Lite r33064 due to improper bounds checking when handling M3U playlist files containing long http:// URL entries. An attacker can craft a malicious .m3u file with a specially formatted URL that triggers a stack overflow when processed by the player, particularly via drag-and-drop interaction. This flaw allows for control of the execution flow through SEH overwrite and a DEP bypass using a ROP chain that leverages known gadgets in loaded DLLs. Successful exploitation may result in arbitrary code execution with the privileges of the current user." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer en la pila en MPlayer Lite r33064 debido a una comprobaci\u00f3n incorrecta de los l\u00edmites al gestionar archivos de listas de reproducci\u00f3n M3U con entradas URL largas con la extensi\u00f3n http://. Un atacante puede manipular un archivo .m3u malicioso con una URL con un formato especial que provoca un desbordamiento de pila al ser procesado por el reproductor, especialmente mediante la interacci\u00f3n de arrastrar y soltar. Esta falla permite controlar el flujo de ejecuci\u00f3n mediante la sobrescritura de SEH y la omisi\u00f3n de DEP mediante una cadena ROP que aprovecha los gadgets conocidos en las DLL cargadas. Una explotaci\u00f3n exitosa puede resultar en la ejecuci\u00f3n de c\u00f3digo arbitrario con los privilegios del usuario actual." } ], "metrics": { diff --git a/CVE-2012/CVE-2012-100xx/CVE-2012-10021.json b/CVE-2012/CVE-2012-100xx/CVE-2012-10021.json index 42571a8e9c6..7cd430316ca 100644 --- a/CVE-2012/CVE-2012-100xx/CVE-2012-10021.json +++ b/CVE-2012/CVE-2012-100xx/CVE-2012-10021.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A stack-based buffer overflow vulnerability exists in D-Link DIR-605L Wireless N300 Cloud Router firmware versions 1.12 and 1.13 via the getAuthCode() function. The flaw arises from unsafe usage of sprintf() when processing user-supplied CAPTCHA data via the FILECODE parameter in /goform/formLogin. A remote unauthenticated attacker can exploit this to execute arbitrary code with root privileges on the device." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer en la pila en las versiones de firmware 1.12 y 1.13 del D-Link DIR-605L Wireless N300 Cloud Router mediante la funci\u00f3n getAuthCode(). La falla se debe al uso inseguro de sprintf() al procesar datos CAPTCHA proporcionados por el usuario mediante el par\u00e1metro FILECODE en /goform/formLogin. Un atacante remoto no autenticado puede explotar esto para ejecutar c\u00f3digo arbitrario con privilegios de root en el dispositivo." } ], "metrics": { diff --git a/CVE-2013/CVE-2013-100xx/CVE-2013-10033.json b/CVE-2013/CVE-2013-100xx/CVE-2013-10033.json index c9d5826bcae..d8918bd7dc2 100644 --- a/CVE-2013/CVE-2013-100xx/CVE-2013-10033.json +++ b/CVE-2013/CVE-2013-100xx/CVE-2013-10033.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An unauthenticated SQL injection vulnerability exists in Kimai version 0.9.2.x via the db_restore.php endpoint. The flaw allows attackers to inject arbitrary SQL queries into the dates[] POST parameter, enabling file write via INTO OUTFILE under specific environmental conditions. This can lead to remote code execution by writing a PHP payload to the web-accessible temporary directory.\u00a0The vulnerability has been confirmed in versions including 0.9.2.beta, 0.9.2.1294.beta, and 0.9.2.1306-3." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de inyecci\u00f3n SQL no autenticada en la versi\u00f3n 0.9.2.x de Kimai a trav\u00e9s del endpoint db_restore.php. Esta falla permite a los atacantes inyectar consultas SQL arbitrarias en el par\u00e1metro POST \u00abdates[]\u00bb, lo que permite la escritura de archivos mediante INTO OUTFILE en condiciones espec\u00edficas. Esto puede provocar la ejecuci\u00f3n remota de c\u00f3digo mediante la escritura de un payload PHP en el directorio temporal accesible desde la web. La vulnerabilidad se ha confirmado en versiones como 0.9.2.beta, 0.9.2.1294.beta y 0.9.2.1306-3." } ], "metrics": { diff --git a/CVE-2013/CVE-2013-100xx/CVE-2013-10034.json b/CVE-2013/CVE-2013-100xx/CVE-2013-10034.json index 389e78268dc..8ae6411195c 100644 --- a/CVE-2013/CVE-2013-100xx/CVE-2013-10034.json +++ b/CVE-2013/CVE-2013-100xx/CVE-2013-10034.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthenticated users to upload files to arbitrary paths via a crafted filename parameter in a multipart/form-data POST request. Due to the lack of authentication and input sanitation, an attacker can upload a file with an .asp extension to a web-accessible directory, which can then be invoked to execute arbitrary code with the privileges of the IUSR account. The vulnerability enables remote code execution without prior authentication and was resolved in version 6.3.0.2 by removing the vulnerable uploadImage.asp endpoint." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de carga de archivos sin restricciones en versiones de Kaseya KServer anteriores a la 6.3.0.2. El endpoint uploadImage.asp permite a usuarios no autenticados cargar archivos a rutas arbitrarias mediante un par\u00e1metro de nombre de archivo manipulado en una solicitud POST multipart/form-data. Debido a la falta de autenticaci\u00f3n y depuraci\u00f3n de entrada, un atacante puede cargar un archivo con la extensi\u00f3n .asp a un directorio accesible desde la web, que posteriormente puede invocarse para ejecutar c\u00f3digo arbitrario con los privilegios de la cuenta IUSR. Esta vulnerabilidad permite la ejecuci\u00f3n remota de c\u00f3digo sin autenticaci\u00f3n previa y se solucion\u00f3 en la versi\u00f3n 6.3.0.2 eliminando el endpoint uploadImage.asp vulnerable." } ], "metrics": { diff --git a/CVE-2013/CVE-2013-100xx/CVE-2013-10035.json b/CVE-2013/CVE-2013-100xx/CVE-2013-10035.json index 9fade794ac1..2bdd9c96099 100644 --- a/CVE-2013/CVE-2013-100xx/CVE-2013-10035.json +++ b/CVE-2013/CVE-2013-100xx/CVE-2013-10035.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPage_Ajax.php, and cases_SchedulerGetPlugins.php, by supplying crafted POST requests to parameters such as action and params. These endpoints fail to validate user input and directly invoke PHP functions like system() with user-supplied parameters, enabling remote code execution. The vulnerability affects both Linux and Windows installations and is present in default configurations of versions including 2.0.23 through 2.5.1. The vulnerable skin cannot be removed through the web interface, and exploitation requires only valid user credentials." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de inyecci\u00f3n de c\u00f3digo en las versiones 2.x de c\u00f3digo abierto de ProcessMaker al usar la interfaz predeterminada \"neoclassic\". Un usuario autenticado puede ejecutar c\u00f3digo PHP arbitrario a trav\u00e9s de m\u00faltiples endpoints, como appFolderAjax.php, casesStartPage_Ajax.php y cases_SchedulerGetPlugins.php, al proporcionar solicitudes POST manipuladas a par\u00e1metros como action y params. Estos endpoints no validan la entrada del usuario e invocan directamente funciones PHP como system() con par\u00e1metros proporcionados por el usuario, lo que permite la ejecuci\u00f3n remota de c\u00f3digo. La vulnerabilidad afecta tanto a instalaciones de Linux como de Windows y est\u00e1 presente en las configuraciones predeterminadas de las versiones 2.0.23 a 2.5.1. La interfaz vulnerable no se puede eliminar a trav\u00e9s de la interfaz web, y para su explotaci\u00f3n solo se requieren credenciales de usuario v\u00e1lidas." } ], "metrics": { diff --git a/CVE-2013/CVE-2013-100xx/CVE-2013-10036.json b/CVE-2013/CVE-2013-100xx/CVE-2013-10036.json index 7e744aceff8..fe02f7eddd8 100644 --- a/CVE-2013/CVE-2013-100xx/CVE-2013-10036.json +++ b/CVE-2013/CVE-2013-100xx/CVE-2013-10036.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A stack-based buffer overflow vulnerability exists in Beetel Connection Manager version PCW_BTLINDV1.0.0B04\u00a0when parsing the UserName parameter in the NetConfig.ini configuration file. A crafted .ini file containing an overly long UserName value can overwrite the Structured Exception Handler (SEH), leading to arbitrary code execution when the application processes the file." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer en la pila en Beetel Connection Manager versi\u00f3n PCW_BTLINDV1.0.0B04 al analizar el par\u00e1metro UserName en el archivo de configuraci\u00f3n NetConfig.ini. Un archivo .ini manipulado que contenga un valor UserName demasiado largo puede sobrescribir el Gestor de Excepciones Estructurado (SEH), lo que provoca la ejecuci\u00f3n de c\u00f3digo arbitrario cuando la aplicaci\u00f3n procesa el archivo." } ], "metrics": { diff --git a/CVE-2013/CVE-2013-100xx/CVE-2013-10037.json b/CVE-2013/CVE-2013-100xx/CVE-2013-10037.json index e8725c82cec..c7a133e82af 100644 --- a/CVE-2013/CVE-2013-100xx/CVE-2013-10037.json +++ b/CVE-2013/CVE-2013-100xx/CVE-2013-10037.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell commands without sanitization. A remote unauthenticated attacker can exploit this flaw by sending a crafted HTTP POST request, resulting in arbitrary command execution on the underlying system with web server privileges." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en WebTester versi\u00f3n 5.x mediante el script de instalaci\u00f3n install2.php. Los par\u00e1metros cpusername, cppassword y cpdomain se pasan directamente a los comandos de shell sin depurarlos. Un atacante remoto no autenticado puede explotar esta vulnerabilidad enviando una solicitud HTTP POST manipulada, lo que resulta en la ejecuci\u00f3n de comandos arbitrarios en el sistema subyacente con privilegios de servidor web." } ], "metrics": { diff --git a/CVE-2013/CVE-2013-100xx/CVE-2013-10038.json b/CVE-2013/CVE-2013-100xx/CVE-2013-10038.json index 77a9a24036f..e8d964e9fa7 100644 --- a/CVE-2013/CVE-2013-100xx/CVE-2013-10038.json +++ b/CVE-2013/CVE-2013-100xx/CVE-2013-10038.json @@ -16,6 +16,10 @@ { "lang": "en", "value": "An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The upload.php endpoint fails to properly validate file types and authentication, allowing attackers to upload malicious PHP scripts. Once uploaded, these scripts can be executed remotely, resulting in arbitrary code execution as the web server user." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de carga arbitraria de archivos sin autenticaci\u00f3n en las versiones 6.0.2 y 6.0.4 a 6.0.8 de FlashChat. El endpoint upload.php no valida correctamente los tipos de archivo ni la autenticaci\u00f3n, lo que permite a los atacantes cargar scripts PHP maliciosos. Una vez cargados, estos scripts pueden ejecutarse en remoto, lo que resulta en la ejecuci\u00f3n de c\u00f3digo arbitrario como si fuera el usuario del servidor web." } ], "metrics": { diff --git a/CVE-2013/CVE-2013-100xx/CVE-2013-10039.json b/CVE-2013/CVE-2013-100xx/CVE-2013-10039.json index 5bd4b78eff1..b390442b05d 100644 --- a/CVE-2013/CVE-2013-100xx/CVE-2013-10039.json +++ b/CVE-2013/CVE-2013-100xx/CVE-2013-10039.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ip_checkhost.cgi. Crafted input to the 'ip' parameter allows attackers to execute arbitrary shell commands on the server via embedded base64-encoded payloads. Authentication may be required depending on deployment configuration." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos en GestioIP 3.0, commit ac67be y versiones anteriores, en ip_checkhost.cgi. Una entrada manipulada en el par\u00e1metro 'ip' permite a los atacantes ejecutar comandos de shell arbitrarios en el servidor mediante payloads incrustadas codificadas en base64. Es posible que se requiera autenticaci\u00f3n seg\u00fan la configuraci\u00f3n de la implementaci\u00f3n." } ], "metrics": { diff --git a/CVE-2013/CVE-2013-100xx/CVE-2013-10040.json b/CVE-2013/CVE-2013-100xx/CVE-2013-10040.json index b470c61e358..a6f202b64ba 100644 --- a/CVE-2013/CVE-2013-100xx/CVE-2013-10040.json +++ b/CVE-2013/CVE-2013-100xx/CVE-2013-10040.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "ClipBucket version 2.6 and earlier contains a critical vulnerability in the ofc_upload_image.php script located at /admin_area/charts/ofc-library/. This endpoint allows unauthenticated users to upload arbitrary files, including executable PHP scripts. Once uploaded, the attacker can access the file via a predictable path and trigger remote code execution." + }, + { + "lang": "es", + "value": "La versi\u00f3n 2.6 y anteriores de ClipBucket contienen una vulnerabilidad cr\u00edtica en el script ofc_upload_image.php, ubicado en /admin_area/charts/ofc-library/. Este endpoint permite a usuarios no autenticados cargar archivos arbitrarios, incluyendo scripts PHP ejecutables. Una vez cargados, el atacante puede acceder al archivo a trav\u00e9s de una ruta predecible y activar la ejecuci\u00f3n remota de c\u00f3digo." } ], "metrics": { diff --git a/CVE-2013/CVE-2013-100xx/CVE-2013-10042.json b/CVE-2013/CVE-2013-100xx/CVE-2013-10042.json index c12b8cdfae1..b240a5fb84d 100644 --- a/CVE-2013/CVE-2013-100xx/CVE-2013-10042.json +++ b/CVE-2013/CVE-2013-100xx/CVE-2013-10042.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A stack-based buffer overflow vulnerability exists in freeFTPd version 1.0.10 and earlier in the handling of the FTP PASS command. When an attacker sends a specially crafted password string, the application fails to validate input length, resulting in memory corruption. This can lead to denial of service or arbitrary code execution. Exploitation requires the anonymous user account to be enabled." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer en la pila en freeFTPd versi\u00f3n 1.0.10 y anteriores, relacionada con el manejo del comando FTP PASS. Cuando un atacante env\u00eda una cadena de contrase\u00f1a especialmente manipulada, la aplicaci\u00f3n no valida la longitud de la entrada, lo que provoca una corrupci\u00f3n de memoria. Esto puede provocar una denegaci\u00f3n de servicio o la ejecuci\u00f3n de c\u00f3digo arbitrario. Para explotarla, es necesario habilitar la cuenta de usuario an\u00f3nima." } ], "metrics": { diff --git a/CVE-2013/CVE-2013-100xx/CVE-2013-10043.json b/CVE-2013/CVE-2013-100xx/CVE-2013-10043.json index aef356010ba..ad8b85a3a4e 100644 --- a/CVE-2013/CVE-2013-100xx/CVE-2013-10043.json +++ b/CVE-2013/CVE-2013-100xx/CVE-2013-10043.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the logon.php script allows an attacker to bypass authentication via SQL injection. Once authenticated as an administrator, the attacker can upload arbitrary PHP code through the importcompany field in import.php, resulting in remote code execution. The malicious payload is injected into /usr/local/astium/web/php/config.php and executed with root privileges by triggering a configuration reload via sudo /sbin/service astcfgd reload. Successful exploitation leads to full system compromise." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad en OAstium VoIP PBX astium-confweb-2.1-25399 y versiones anteriores, donde una validaci\u00f3n de entrada incorrecta en el script logon.php permite a un atacante eludir la autenticaci\u00f3n mediante inyecci\u00f3n SQL. Una vez autenticado como administrador, el atacante puede cargar c\u00f3digo PHP arbitrario a trav\u00e9s del campo importcompany en import.php, lo que resulta en la ejecuci\u00f3n remota de c\u00f3digo. El payload malicioso se inyecta en /usr/local/astium/web/php/config.php y se ejecuta con privilegios de root al activar una recarga de la configuraci\u00f3n mediante sudo /sbin/service astcfgd reload. Una explotaci\u00f3n exitosa compromete completamente el sistema." } ], "metrics": { diff --git a/CVE-2014/CVE-2014-1251xx/CVE-2014-125121.json b/CVE-2014/CVE-2014-1251xx/CVE-2014-125121.json index af7e8e864dc..2108fc424ed 100644 --- a/CVE-2014/CVE-2014-1251xx/CVE-2014-125121.json +++ b/CVE-2014/CVE-2014-1251xx/CVE-2014-125121.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vulnerability caused by a combination of hardcoded SSH credentials (or SSH private key) and insecure permissions on a startup script. The devices ship with a default SSH login\u00a0or a hardcoded DSA private key, allowing an attacker to authenticate remotely with limited privileges.\n\n\nOnce authenticated, an attacker can overwrite the world-writable /ca/bin/monitor.sh script with arbitrary commands. Since this script is executed with elevated privileges through the backend binary, enabling the debug monitor via backend -c \"debug monitor on\" triggers execution of the attacker's payload as root. This allows full system compromise." + }, + { + "lang": "es", + "value": "Los dispositivos vAPV (versi\u00f3n 8.3.2.17) y vxAG (versi\u00f3n 9.2.0.34) de Array Networks se ven afectados por una vulnerabilidad de escalada de privilegios causada por una combinaci\u00f3n de credenciales SSH (o clave privada SSH) codificadas y permisos inseguros en un script de inicio. Los dispositivos se entregan con un inicio de sesi\u00f3n SSH predeterminado o una clave privada DSA codificada, lo que permite a un atacante autenticarse remotamente con privilegios limitados. Una vez autenticado, un atacante puede sobrescribir el script /ca/bin/monitor.sh, con permisos de escritura universal, con comandos arbitrarios. Dado que este script se ejecuta con privilegios elevados a trav\u00e9s del binario del backend, al habilitar el monitor de depuraci\u00f3n mediante backend -c \"debug monitor on\", se activa la ejecuci\u00f3n del payload del atacante como root. Esto permite una vulnerabilidad completa del sistema." } ], "metrics": { diff --git a/CVE-2014/CVE-2014-1251xx/CVE-2014-125122.json b/CVE-2014/CVE-2014-1251xx/CVE-2014-125122.json index b570fc05a4c..2ed238209de 100644 --- a/CVE-2014/CVE-2014-1251xx/CVE-2014-125122.json +++ b/CVE-2014/CVE-2014-1251xx/CVE-2014-125122.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router. The vulnerability is triggered by sending a specially crafted HTTP POST request with an overly long TM_Block_URL parameter to the endpoint. By exploiting this flaw, an unauthenticated remote attacker can overwrite memory in a controlled manner, enabling them to temporarily reset the administrator password of the device to a blank value. This grants unauthorized access to the router\u2019s web management interface without requiring valid credentials." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer en la pila en el endpoint tmUnblock.cgi del router inal\u00e1mbrico Linksys WRT120N. La vulnerabilidad se activa al enviar una solicitud HTTP POST especialmente manipulada con un par\u00e1metro TM_Block_URL demasiado largo al endpoint. Al explotar esta vulnerabilidad, un atacante remoto no autenticado puede sobrescribir la memoria de forma controlada, lo que le permite restablecer temporalmente la contrase\u00f1a de administrador del dispositivo a un valor vac\u00edo. Esto permite el acceso no autorizado a la interfaz de administraci\u00f3n web del router sin necesidad de credenciales v\u00e1lidas." } ], "metrics": { diff --git a/CVE-2014/CVE-2014-1251xx/CVE-2014-125123.json b/CVE-2014/CVE-2014-1251xx/CVE-2014-125123.json index 6ac7cfbc764..9afb134d621 100644 --- a/CVE-2014/CVE-2014-1251xx/CVE-2014-125123.json +++ b/CVE-2014/CVE-2014-1251xx/CVE-2014-125123.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An unauthenticated SQL injection vulnerability exists in the Kloxo web hosting control panel (developed by LXCenter) prior to version 6.1.12. The flaw resides in the login-name parameter passed to lbin/webcommand.php, which fails to properly sanitize input, allowing an attacker to extract the administrator\u2019s password from the backend database. After recovering valid credentials, the attacker can authenticate to the Kloxo control panel and leverage the Command Center feature (display.php) to execute arbitrary operating system commands as root on the underlying host system. This vulnerability was reported to be exploited in the wild in January 2014." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de inyecci\u00f3n SQL no autenticada en el panel de control de alojamiento web Kloxo (desarrollado por LXCenter) anterior a la versi\u00f3n 6.1.12. La falla reside en el par\u00e1metro login-name pasado a lbin/webcommand.php, que no depura correctamente la entrada, lo que permite a un atacante extraer la contrase\u00f1a del administrador de la base de datos del servidor. Tras recuperar credenciales v\u00e1lidas, el atacante puede autenticarse en el panel de control Kloxo y usar la funci\u00f3n del Centro de Comandos (display.php) para ejecutar comandos arbitrarios del sistema operativo como root en el sistema host subyacente. Se inform\u00f3 de la explotaci\u00f3n de esta vulnerabilidad en enero de 2014." } ], "metrics": { diff --git a/CVE-2014/CVE-2014-1251xx/CVE-2014-125124.json b/CVE-2014/CVE-2014-1251xx/CVE-2014-125124.json index 6252887a77e..d8f4e6d5c2e 100644 --- a/CVE-2014/CVE-2014-1251xx/CVE-2014-125124.json +++ b/CVE-2014/CVE-2014-1251xx/CVE-2014-125124.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell command, allowing arbitrary command execution as the pandora user. In certain versions (notably 4.1 and 5.0RC1), the pandora user can elevate privileges to root without a password using a chain involving the artica user account. This account is typically installed without a password and is configured to run sudo without authentication. Therefore, full system compromise is possible without any credentials." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de ejecuci\u00f3n remota de comandos no autenticados en las versiones de Pandora FMS hasta la 5.0RC1 incluida a trav\u00e9s de la interfaz web de Anyterm, que escucha en el puerto TCP 8023. El endpoint anyterm-module acepta la entrada de usuario no autorizada mediante el par\u00e1metro p y la inyecta directamente en un comando de shell, lo que permite la ejecuci\u00f3n de comandos arbitrarios como usuario de Pandora. En ciertas versiones (en particular, la 4.1 y la 5.0RC1), el usuario de Pandora puede elevar los privilegios a root sin contrase\u00f1a mediante una cadena que incluye la cuenta de usuario artica. Esta cuenta suele instalarse sin contrase\u00f1a y est\u00e1 configurada para ejecutar sudo sin autenticaci\u00f3n. Por lo tanto, es posible comprometer completamente el sistema sin credenciales." } ], "metrics": { diff --git a/CVE-2014/CVE-2014-1251xx/CVE-2014-125125.json b/CVE-2014/CVE-2014-1251xx/CVE-2014-125125.json index b814fba5688..4f3d1425976 100644 --- a/CVE-2014/CVE-2014-1251xx/CVE-2014-125125.json +++ b/CVE-2014/CVE-2014-1251xx/CVE-2014-125125.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the handling of the filename parameter in the /xml/downloads endpoint, which fails to properly sanitize user input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP requests containing directory traversal sequences to read arbitrary files outside the intended directory. The files returned by the vulnerable endpoint are deleted from the system after retrieval. This can lead to unauthorized disclosure of sensitive information such as SSL certificates and private keys, as well as unintended file deletion." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de path traversal en las versiones 2.6.1-GR1-P5, 2.7.0 y anteriores de A10 Networks AX Loadbalancer. La vulnerabilidad reside en la gesti\u00f3n del par\u00e1metro filename en el endpoint /xml/downloads, que no depura correctamente la entrada del usuario. Un atacante no autenticado puede explotar esta vulnerabilidad enviando solicitudes HTTP manipuladas que contienen secuencias de directory traversal para leer archivos arbitrarios fuera del directorio de destino. Los archivos devueltos por el endpoint vulnerable se eliminan del sistema tras su recuperaci\u00f3n. Esto puede provocar la divulgaci\u00f3n no autorizada de informaci\u00f3n confidencial, como certificados SSL y claves privadas, as\u00ed como la eliminaci\u00f3n involuntaria de archivos." } ], "metrics": { diff --git a/CVE-2014/CVE-2014-1251xx/CVE-2014-125126.json b/CVE-2014/CVE-2014-1251xx/CVE-2014-125126.json index 606445e7599..c971463ab45 100644 --- a/CVE-2014/CVE-2014-1251xx/CVE-2014-125126.json +++ b/CVE-2014/CVE-2014-1251xx/CVE-2014-125126.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cookie header (access=3) with HTTP requests.\u00a0The application\u2019s upload mechanism fails to restrict file types and does not validate or sanitize user-supplied input, allowing attackers to upload malicious .php scripts. Authentication can be bypassed entirely by supplying a specially crafted cookie (access=3), granting access to the upload functionality without valid credentials. If file uploads are enabled on the server, the attacker can upload a web shell and gain remote code execution with the privileges of the web server user, potentially leading to full system compromise." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de carga de archivos sin restricciones en las versiones 3.0 a 3.1 de Simple E-Document que permite a un atacante no autenticado eludir la autenticaci\u00f3n mediante el env\u00edo de un encabezado de cookie espec\u00edfico (access=3) con las solicitudes HTTP. El mecanismo de carga de la aplicaci\u00f3n no restringe los tipos de archivo ni valida ni depura la informaci\u00f3n proporcionada por el usuario, lo que permite a los atacantes cargar scripts .php maliciosos. La autenticaci\u00f3n se puede eludir por completo mediante el suministro de una cookie especialmente manipulada (access=3), que otorga acceso a la funci\u00f3n de carga sin credenciales v\u00e1lidas. Si la carga de archivos est\u00e1 habilitada en el servidor, el atacante puede cargar un shell web y obtener la ejecuci\u00f3n remota de c\u00f3digo con los privilegios del usuario del servidor web, lo que podr\u00eda comprometer por completo el sistema." } ], "metrics": { diff --git a/CVE-2015/CVE-2015-101xx/CVE-2015-10141.json b/CVE-2015/CVE-2015-101xx/CVE-2015-10141.json index a118ca00c80..27070fba22d 100644 --- a/CVE-2015/CVE-2015-101xx/CVE-2015-10141.json +++ b/CVE-2015/CVE-2015-101xx/CVE-2015-10141.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos no autenticados en Xdebug, una extensi\u00f3n de depuraci\u00f3n de PHP desarrollada por Derick Rethans, en las versiones 2.5.5 y anteriores. Cuando la depuraci\u00f3n remota est\u00e1 habilitada, Xdebug escucha en el puerto 9000 y acepta comandos del protocolo del depurador sin autenticaci\u00f3n. Un atacante puede enviar un comando eval manipulado a trav\u00e9s de esta interfaz para ejecutar c\u00f3digo PHP arbitrario, que puede invocar funciones a nivel de sistema como system() o passthru(). Esto compromete completamente el host bajo los privilegios del usuario del servidor web." } ], "metrics": { diff --git a/CVE-2015/CVE-2015-101xx/CVE-2015-10143.json b/CVE-2015/CVE-2015-101xx/CVE-2015-10143.json index 08033058485..cdaab958783 100644 --- a/CVE-2015/CVE-2015-101xx/CVE-2015-10143.json +++ b/CVE-2015/CVE-2015-101xx/CVE-2015-10143.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the *_ajax_save_options() function in all versions up to 1.4.4 (exclusive). This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site." + }, + { + "lang": "es", + "value": "El tema Platform para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos, lo que puede provocar una escalada de privilegios debido a la falta de comprobaci\u00f3n de la funci\u00f3n *_ajax_save_options() en todas las versiones hasta la 1.4.4 (exclusiva). Esto permite a atacantes no autenticados actualizar opciones arbitrarias en el sitio de WordPress. Esto puede aprovecharse para actualizar el rol predeterminado de registro a administrador y habilitar el registro de usuarios para que los atacantes obtengan acceso administrativo a un sitio vulnerable." } ], "metrics": { diff --git a/CVE-2015/CVE-2015-101xx/CVE-2015-10144.json b/CVE-2015/CVE-2015-101xx/CVE-2015-10144.json index 0c0e4f66348..5a5885f8fac 100644 --- a/CVE-2015/CVE-2015-101xx/CVE-2015-10144.json +++ b/CVE-2015/CVE-2015-101xx/CVE-2015-10144.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected sites server using a double extension which may make remote code execution possible." + }, + { + "lang": "es", + "value": "El complemento Responsive Thumbnail Slider para WordPress es vulnerable a la carga de archivos arbitrarios debido a la falta de depuraci\u00f3n del tipo de archivo en el cargador de im\u00e1genes en versiones anteriores a la 1.0.1. Esto permite que atacantes autenticados, con acceso de suscriptor o superior, carguen archivos arbitrarios en el servidor de los sitios afectados mediante una extensi\u00f3n doble, lo que podr\u00eda posibilitar la ejecuci\u00f3n remota de c\u00f3digo." } ], "metrics": { diff --git a/CVE-2016/CVE-2016-150xx/CVE-2016-15044.json b/CVE-2016/CVE-2016-150xx/CVE-2016-15044.json index 1dd9f04372b..5dfb3b4cc7e 100644 --- a/CVE-2016/CVE-2016-150xx/CVE-2016-15044.json +++ b/CVE-2016/CVE-2016-150xx/CVE-2016-15044.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorservices module. An unauthenticated remote attacker can exploit this issue by sending a specially crafted serialized PHP object in the kdata GET parameter to the redirectWidgetCmd endpoint. Successful exploitation leads to execution of arbitrary PHP code in the context of the web server process." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en las versiones de Kaltura anteriores a la 11.1.0-2 debido a la deserializaci\u00f3n insegura de datos controlados por el usuario dentro del m\u00f3dulo keditorservices. Un atacante remoto no autenticado puede explotar este problema enviando un objeto PHP serializado especialmente manipulado en el par\u00e1metro GET de kdata al endpoint redirectWidgetCmd. Una explotaci\u00f3n exitosa conlleva la ejecuci\u00f3n de c\u00f3digo PHP arbitrario en el contexto del proceso del servidor web." } ], "metrics": { diff --git a/CVE-2016/CVE-2016-150xx/CVE-2016-15045.json b/CVE-2016/CVE-2016-150xx/CVE-2016-15045.json index ed84ffcec07..7c404c56e59 100644 --- a/CVE-2016/CVE-2016-150xx/CVE-2016-15045.json +++ b/CVE-2016/CVE-2016-150xx/CVE-2016-15045.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technology Co., Ltd.). In versions 0.9.53-1 (Deepin 15.5) and 0.9.66-1 (Deepin 15.7), the D-Bus configuration permits any user in the sudo group to invoke the InstallPackage method without password authentication. By default, the first user created on Deepin is in the sudo group. An attacker with shell access can craft a .deb package containing a malicious post-install script and use dbus-send to install it via lastore-daemon, resulting in arbitrary code execution as root." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de escalada de privilegios local en lastore-daemon, el gestor de paquetes del sistema utilizado en Deepin Linux (desarrollado por Wuhan Deepin Technology Co., Ltd.). En las versiones 0.9.53-1 (Deepin 15.5) y 0.9.66-1 (Deepin 15.7), la configuraci\u00f3n de D-Bus permite a cualquier usuario del grupo sudo invocar el m\u00e9todo InstallPackage sin autenticaci\u00f3n de contrase\u00f1a. Por defecto, el primer usuario creado en Deepin pertenece al grupo sudo. Un atacante con acceso a la shell puede manipular un paquete .deb que contenga un script malicioso posterior a la instalaci\u00f3n y usar dbus-send para instalarlo mediante lastore-daemon, lo que provoca la ejecuci\u00f3n de c\u00f3digo arbitrario como root." } ], "metrics": { diff --git a/CVE-2017/CVE-2017-201xx/CVE-2017-20198.json b/CVE-2017/CVE-2017-201xx/CVE-2017-20198.json index 5f943249169..76882cfff0f 100644 --- a/CVE-2017/CVE-2017-201xx/CVE-2017-20198.json +++ b/CVE-2017/CVE-2017-201xx/CVE-2017-20198.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement." + }, + { + "lang": "es", + "value": "La interfaz de usuario de Marathon en DC/OS anterior a la versi\u00f3n 1.9.0 permite a usuarios no autenticados implementar contenedores Docker arbitrarios. Debido a la restricci\u00f3n incorrecta de las configuraciones de montaje de vol\u00famenes, los atacantes pueden implementar un contenedor que monta el sistema de archivos root del host (/) con privilegios de lectura y escritura. Al usar una imagen de Docker maliciosa, el atacante puede escribir en /etc/cron.d/ del host, lo que permite la ejecuci\u00f3n de c\u00f3digo arbitrario con privilegios de root. Esto afecta a cualquier sistema donde el demonio de Docker respete las configuraciones de los contenedores de Marathon sin la aplicaci\u00f3n de pol\u00edticas." } ], "metrics": { diff --git a/CVE-2018/CVE-2018-251xx/CVE-2018-25110.json b/CVE-2018/CVE-2018-251xx/CVE-2018-25110.json index 1f9a0a52201..96b580476ab 100644 --- a/CVE-2018/CVE-2018-251xx/CVE-2018-25110.json +++ b/CVE-2018/CVE-2018-251xx/CVE-2018-25110.json @@ -3,7 +3,7 @@ "sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "published": "2025-05-23T15:15:20.210", "lastModified": "2025-05-23T15:54:42.643", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2018/CVE-2018-251xx/CVE-2018-25113.json b/CVE-2018/CVE-2018-251xx/CVE-2018-25113.json index 5796859258c..aaa5c64096c 100644 --- a/CVE-2018/CVE-2018-251xx/CVE-2018-25113.json +++ b/CVE-2018/CVE-2018-251xx/CVE-2018-25113.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter. Successful exploitation can reveal sensitive files accessible by the web server user." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de path traversal no autenticado en el servidor web Dicoogle PACS versi\u00f3n 2.5.0 y posiblemente anteriores. Esta vulnerabilidad permite a atacantes remotos leer archivos arbitrarios en el sistema subyacente mediante el env\u00edo de una solicitud manipulada al endpoint /exportFile con el par\u00e1metro UID. Una explotaci\u00f3n exitosa puede revelar archivos confidenciales accesibles para el usuario del servidor web." } ], "metrics": { diff --git a/CVE-2018/CVE-2018-251xx/CVE-2018-25114.json b/CVE-2018/CVE-2018-251xx/CVE-2018-25114.json index 01dfb907367..ab9c345be57 100644 --- a/CVE-2018/CVE-2018-251xx/CVE-2018-25114.json +++ b/CVE-2018/CVE-2018-251xx/CVE-2018-25114.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install_4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application later includes this file, the injected payload is executed, resulting in full server-side compromise." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en osCommerce Online Merchant versi\u00f3n 2.3.4.1 debido a una configuraci\u00f3n predeterminada insegura y a la falta de autenticaci\u00f3n en el flujo de trabajo del instalador. Por defecto, el directorio /install/ permanece accesible despu\u00e9s de la instalaci\u00f3n. Un atacante no autenticado puede invocar install_4.php, enviar datos POST manipulados e inyectar c\u00f3digo PHP arbitrario en el archivo configure.php. Cuando la aplicaci\u00f3n incluye posteriormente este archivo, se ejecuta el payload inyectado, lo que resulta en una vulnerabilidad completa del servidor." } ], "metrics": { diff --git a/CVE-2019/CVE-2019-191xx/CVE-2019-19145.json b/CVE-2019/CVE-2019-191xx/CVE-2019-19145.json index bdc65e46d69..e44544c121c 100644 --- a/CVE-2019/CVE-2019-191xx/CVE-2019-19145.json +++ b/CVE-2019/CVE-2019-191xx/CVE-2019-19145.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Quantum SuperLoader 3 V94.0 005E.0h devices allow attackers to access the hardcoded fa account because there are only 65536 possible passwords." + }, + { + "lang": "es", + "value": "Los dispositivos Quantum SuperLoader 3 V94.0 005E.0h permiten a los atacantes acceder a la cuenta fa codificada porque solo hay 65536 contrase\u00f1as posibles." } ], "metrics": { diff --git a/CVE-2019/CVE-2019-252xx/CVE-2019-25224.json b/CVE-2019/CVE-2019-252xx/CVE-2019-25224.json index 5697b9423dd..ec8c9dd64d5 100644 --- a/CVE-2019/CVE-2019-252xx/CVE-2019-25224.json +++ b/CVE-2019/CVE-2019-252xx/CVE-2019-25224.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system." + }, + { + "lang": "es", + "value": "El complemento WP Database Backup para WordPress es vulnerable a la inyecci\u00f3n de comandos del sistema operativo en versiones anteriores a la 5.2 mediante la funci\u00f3n mysqldump. Esta vulnerabilidad permite a atacantes no autenticados ejecutar comandos arbitrarios en el sistema operativo host." } ], "metrics": { diff --git a/CVE-2020/CVE-2020-260xx/CVE-2020-26062.json b/CVE-2020/CVE-2020-260xx/CVE-2020-26062.json index e342e571320..9eecd8fc860 100644 --- a/CVE-2020/CVE-2020-260xx/CVE-2020-26062.json +++ b/CVE-2020/CVE-2020-260xx/CVE-2020-26062.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:05.170", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2020/CVE-2020-260xx/CVE-2020-26066.json b/CVE-2020/CVE-2020-260xx/CVE-2020-26066.json index a8f2c0424b5..81889e03830 100644 --- a/CVE-2020/CVE-2020-260xx/CVE-2020-26066.json +++ b/CVE-2020/CVE-2020-260xx/CVE-2020-26066.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T17:15:09.437", "lastModified": "2024-11-19T21:57:56.293", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2020/CVE-2020-260xx/CVE-2020-26071.json b/CVE-2020/CVE-2020-260xx/CVE-2020-26071.json index f76cae56af7..11c17039981 100644 --- a/CVE-2020/CVE-2020-260xx/CVE-2020-26071.json +++ b/CVE-2020/CVE-2020-260xx/CVE-2020-26071.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:05.710", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2020/CVE-2020-260xx/CVE-2020-26073.json b/CVE-2020/CVE-2020-260xx/CVE-2020-26073.json index 33e71193211..49d2af37742 100644 --- a/CVE-2020/CVE-2020-260xx/CVE-2020-26073.json +++ b/CVE-2020/CVE-2020-260xx/CVE-2020-26073.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:05.947", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2020/CVE-2020-260xx/CVE-2020-26074.json b/CVE-2020/CVE-2020-260xx/CVE-2020-26074.json index 3f4c330ca09..59bbd5eb076 100644 --- a/CVE-2020/CVE-2020-260xx/CVE-2020-26074.json +++ b/CVE-2020/CVE-2020-260xx/CVE-2020-26074.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:06.170", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2020/CVE-2020-34xx/CVE-2020-3420.json b/CVE-2020/CVE-2020-34xx/CVE-2020-3420.json index fc403645d43..4136b68a9ec 100644 --- a/CVE-2020/CVE-2020-34xx/CVE-2020-3420.json +++ b/CVE-2020/CVE-2020-34xx/CVE-2020-3420.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:06.630", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2020/CVE-2020-34xx/CVE-2020-3431.json b/CVE-2020/CVE-2020-34xx/CVE-2020-3431.json index cb669afe14d..5e18351d17b 100644 --- a/CVE-2020/CVE-2020-34xx/CVE-2020-3431.json +++ b/CVE-2020/CVE-2020-34xx/CVE-2020-3431.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:06.897", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2020/CVE-2020-35xx/CVE-2020-3538.json b/CVE-2020/CVE-2020-35xx/CVE-2020-3538.json index 26979fefbfc..789c6cd5d37 100644 --- a/CVE-2020/CVE-2020-35xx/CVE-2020-3538.json +++ b/CVE-2020/CVE-2020-35xx/CVE-2020-3538.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:07.660", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-11xx/CVE-2021-1132.json b/CVE-2021/CVE-2021-11xx/CVE-2021-1132.json index aad280a7f29..4910a4e8a7e 100644 --- a/CVE-2021/CVE-2021-11xx/CVE-2021-1132.json +++ b/CVE-2021/CVE-2021-11xx/CVE-2021-1132.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:08.343", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-12xx/CVE-2021-1232.json b/CVE-2021/CVE-2021-12xx/CVE-2021-1232.json index 4485c7aa42a..46e5014a64f 100644 --- a/CVE-2021/CVE-2021-12xx/CVE-2021-1232.json +++ b/CVE-2021/CVE-2021-12xx/CVE-2021-1232.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:08.567", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-12xx/CVE-2021-1234.json b/CVE-2021/CVE-2021-12xx/CVE-2021-1234.json index 7258440f874..a59eaa4a97e 100644 --- a/CVE-2021/CVE-2021-12xx/CVE-2021-1234.json +++ b/CVE-2021/CVE-2021-12xx/CVE-2021-1234.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:08.813", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-14xx/CVE-2021-1410.json b/CVE-2021/CVE-2021-14xx/CVE-2021-1410.json index 2be339885b1..d1d3ce68fba 100644 --- a/CVE-2021/CVE-2021-14xx/CVE-2021-1410.json +++ b/CVE-2021/CVE-2021-14xx/CVE-2021-1410.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:09.553", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-14xx/CVE-2021-1444.json b/CVE-2021/CVE-2021-14xx/CVE-2021-1444.json index 454aa07bfe2..fe7e5a55e9b 100644 --- a/CVE-2021/CVE-2021-14xx/CVE-2021-1444.json +++ b/CVE-2021/CVE-2021-14xx/CVE-2021-1444.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:10.627", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-14xx/CVE-2021-1461.json b/CVE-2021/CVE-2021-14xx/CVE-2021-1461.json index 4e065ef3422..88356a26b87 100644 --- a/CVE-2021/CVE-2021-14xx/CVE-2021-1461.json +++ b/CVE-2021/CVE-2021-14xx/CVE-2021-1461.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:10.850", "lastModified": "2024-11-21T05:44:24.867", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-14xx/CVE-2021-1462.json b/CVE-2021/CVE-2021-14xx/CVE-2021-1462.json index fcff39c3ff0..975dfbac15a 100644 --- a/CVE-2021/CVE-2021-14xx/CVE-2021-1462.json +++ b/CVE-2021/CVE-2021-14xx/CVE-2021-1462.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:11.087", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-14xx/CVE-2021-1464.json b/CVE-2021/CVE-2021-14xx/CVE-2021-1464.json index bee1cfd6ba8..ce82ded6230 100644 --- a/CVE-2021/CVE-2021-14xx/CVE-2021-1464.json +++ b/CVE-2021/CVE-2021-14xx/CVE-2021-1464.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T17:15:07.350", "lastModified": "2024-11-18T17:11:56.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-14xx/CVE-2021-1465.json b/CVE-2021/CVE-2021-14xx/CVE-2021-1465.json index c7d9f14739f..3d0bc094c50 100644 --- a/CVE-2021/CVE-2021-14xx/CVE-2021-1465.json +++ b/CVE-2021/CVE-2021-14xx/CVE-2021-1465.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-18T16:15:11.350", "lastModified": "2024-11-18T17:11:17.393", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-14xx/CVE-2021-1466.json b/CVE-2021/CVE-2021-14xx/CVE-2021-1466.json index e8342607975..6c4af9965ed 100644 --- a/CVE-2021/CVE-2021-14xx/CVE-2021-1466.json +++ b/CVE-2021/CVE-2021-14xx/CVE-2021-1466.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T17:15:07.670", "lastModified": "2024-11-18T17:11:56.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-14xx/CVE-2021-1481.json b/CVE-2021/CVE-2021-14xx/CVE-2021-1481.json index 728858a72c8..ae64edf6e45 100644 --- a/CVE-2021/CVE-2021-14xx/CVE-2021-1481.json +++ b/CVE-2021/CVE-2021-14xx/CVE-2021-1481.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T17:15:08.277", "lastModified": "2024-11-18T17:11:56.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-14xx/CVE-2021-1482.json b/CVE-2021/CVE-2021-14xx/CVE-2021-1482.json index 087f2e9b429..53180195ed3 100644 --- a/CVE-2021/CVE-2021-14xx/CVE-2021-1482.json +++ b/CVE-2021/CVE-2021-14xx/CVE-2021-1482.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T17:15:08.530", "lastModified": "2024-11-18T17:11:56.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-14xx/CVE-2021-1483.json b/CVE-2021/CVE-2021-14xx/CVE-2021-1483.json index 67cc9a6a0f3..08c064b1f99 100644 --- a/CVE-2021/CVE-2021-14xx/CVE-2021-1483.json +++ b/CVE-2021/CVE-2021-14xx/CVE-2021-1483.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T17:15:08.760", "lastModified": "2024-11-18T17:11:56.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-14xx/CVE-2021-1484.json b/CVE-2021/CVE-2021-14xx/CVE-2021-1484.json index 8ec22d5d1ff..4047c442f19 100644 --- a/CVE-2021/CVE-2021-14xx/CVE-2021-1484.json +++ b/CVE-2021/CVE-2021-14xx/CVE-2021-1484.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T17:15:08.983", "lastModified": "2024-11-18T17:11:56.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2021/CVE-2021-14xx/CVE-2021-1491.json b/CVE-2021/CVE-2021-14xx/CVE-2021-1491.json index 816fd7ae269..a84a88e682f 100644 --- a/CVE-2021/CVE-2021-14xx/CVE-2021-1491.json +++ b/CVE-2021/CVE-2021-14xx/CVE-2021-1491.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T17:15:09.220", "lastModified": "2024-11-18T17:11:56.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2022/CVE-2022-206xx/CVE-2022-20626.json b/CVE-2022/CVE-2022-206xx/CVE-2022-20626.json index cef932fc1fd..499698dd145 100644 --- a/CVE-2022/CVE-2022-206xx/CVE-2022-20626.json +++ b/CVE-2022/CVE-2022-206xx/CVE-2022-20626.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T16:15:19.287", "lastModified": "2024-11-18T17:11:56.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2022/CVE-2022-206xx/CVE-2022-20634.json b/CVE-2022/CVE-2022-206xx/CVE-2022-20634.json index e60917acd1f..691a142d58f 100644 --- a/CVE-2022/CVE-2022-206xx/CVE-2022-20634.json +++ b/CVE-2022/CVE-2022-206xx/CVE-2022-20634.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T16:15:19.747", "lastModified": "2024-11-18T17:11:56.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2022/CVE-2022-206xx/CVE-2022-20654.json b/CVE-2022/CVE-2022-206xx/CVE-2022-20654.json index 5120207c592..ec1354182d7 100644 --- a/CVE-2022/CVE-2022-206xx/CVE-2022-20654.json +++ b/CVE-2022/CVE-2022-206xx/CVE-2022-20654.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T16:15:20.767", "lastModified": "2024-11-18T17:11:56.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2022/CVE-2022-208xx/CVE-2022-20846.json b/CVE-2022/CVE-2022-208xx/CVE-2022-20846.json index d48b888062f..bd00301b061 100644 --- a/CVE-2022/CVE-2022-208xx/CVE-2022-20846.json +++ b/CVE-2022/CVE-2022-208xx/CVE-2022-20846.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T16:15:23.120", "lastModified": "2024-11-21T06:43:40.553", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2022/CVE-2022-421xx/CVE-2022-42136.json b/CVE-2022/CVE-2022-421xx/CVE-2022-42136.json index 1d89d507f57..744269574ab 100644 --- a/CVE-2022/CVE-2022-421xx/CVE-2022-42136.json +++ b/CVE-2022/CVE-2022-421xx/CVE-2022-42136.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Los usuarios de correo autenticados, en circunstancias espec\u00edficas, pod\u00edan agregar archivos con contenido no desinfectado en carpetas p\u00fablicas a las que el usuario de IIS ten\u00eda permiso para acceder. Esa acci\u00f3n podr\u00eda llevar a un atacante a almacenar c\u00f3digo arbitrario en esos archivos y ejecutar comandos RCE." + "value": "Los usuarios de correo autenticados, en circunstancias espec\u00edficas, pod\u00edan agregar archivos con contenido no depurado en carpetas p\u00fablicas a las que el usuario de IIS ten\u00eda permiso para acceder. Esa acci\u00f3n podr\u00eda llevar a un atacante a almacenar c\u00f3digo arbitrario en esos archivos y ejecutar comandos RCE." } ], "metrics": { diff --git a/CVE-2022/CVE-2022-467xx/CVE-2022-46732.json b/CVE-2022/CVE-2022-467xx/CVE-2022-46732.json index 0a3b2dc5b9f..42db4bd732e 100644 --- a/CVE-2022/CVE-2022-467xx/CVE-2022-46732.json +++ b/CVE-2022/CVE-2022-467xx/CVE-2022-46732.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Incluso si falla la autenticaci\u00f3n del servicio local, el comando solicitado a\u00fan podr\u00eda ejecutarse independientemente del estado de autenticaci\u00f3n." + "value": "ncluso si falla la autenticaci\u00f3n del servicio local, el comando solicitado a\u00fan podr\u00eda ejecutarse independientemente del estado de autenticaci\u00f3n." } ], "metrics": { diff --git a/CVE-2022/CVE-2022-49xx/CVE-2022-4978.json b/CVE-2022/CVE-2022-49xx/CVE-2022-4978.json index f2fa01fbbb0..62b27367c21 100644 --- a/CVE-2022/CVE-2022-49xx/CVE-2022-4978.json +++ b/CVE-2022/CVE-2022-49xx/CVE-2022-4978.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Remote Control Server, maintained by\u00a0Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default configuration. The server exposes a custom UDP-based control protocol that accepts remote keyboard input events without verification. An attacker on the same network can issue a sequence of keystroke commands to launch a system shell and execute arbitrary commands, resulting in full system compromise." + }, + { + "lang": "es", + "value": "El Servidor de Control Remoto, mantenido por Steppschuh, versi\u00f3n 3.1.1.12, permite la ejecuci\u00f3n remota de c\u00f3digo sin autenticaci\u00f3n cuando la autenticaci\u00f3n est\u00e1 deshabilitada, que es la configuraci\u00f3n predeterminada. El servidor expone un protocolo de control personalizado basado en UDP que acepta eventos de entrada de teclado remotos sin verificaci\u00f3n. Un atacante en la misma red puede ejecutar una secuencia de comandos de teclado para iniciar un shell del sistema y ejecutar comandos arbitrarios, lo que compromete por completo el sistema." } ], "metrics": { diff --git a/CVE-2023/CVE-2023-200xx/CVE-2023-20036.json b/CVE-2023/CVE-2023-200xx/CVE-2023-20036.json index 36fece38f26..058019367f5 100644 --- a/CVE-2023/CVE-2023-200xx/CVE-2023-20036.json +++ b/CVE-2023/CVE-2023-200xx/CVE-2023-20036.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T16:15:24.950", "lastModified": "2024-11-18T17:11:56.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2023/CVE-2023-200xx/CVE-2023-20039.json b/CVE-2023/CVE-2023-200xx/CVE-2023-20039.json index 422434bf3e1..f11aa262b81 100644 --- a/CVE-2023/CVE-2023-200xx/CVE-2023-20039.json +++ b/CVE-2023/CVE-2023-200xx/CVE-2023-20039.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T16:15:25.157", "lastModified": "2024-11-18T17:11:56.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2023/CVE-2023-201xx/CVE-2023-20154.json b/CVE-2023/CVE-2023-201xx/CVE-2023-20154.json index a7041c16834..ab3260eb089 100644 --- a/CVE-2023/CVE-2023-201xx/CVE-2023-20154.json +++ b/CVE-2023/CVE-2023-201xx/CVE-2023-20154.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-15T15:15:05.697", "lastModified": "2024-11-18T17:11:56.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2023/CVE-2023-322xx/CVE-2023-32251.json b/CVE-2023/CVE-2023-322xx/CVE-2023-32251.json index 36bd253ca85..5a71f24b2fb 100644 --- a/CVE-2023/CVE-2023-322xx/CVE-2023-32251.json +++ b/CVE-2023/CVE-2023-322xx/CVE-2023-32251.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A vulnerability has been identified in the Linux kernel's ksmbd component (kernel SMB/CIFS server). A security control designed to prevent dictionary attacks, which introduces a 5-second delay during session setup, can be bypassed through the use of asynchronous requests. This bypass negates the intended anti-brute-force protection, potentially allowing attackers to conduct dictionary attacks more efficiently against user credentials or other authentication mechanisms." + }, + { + "lang": "es", + "value": "Se ha identificado una vulnerabilidad en el componente ksmbd del kernel de Linux (servidor SMB/CIFS del kernel). Un control de seguridad dise\u00f1ado para prevenir ataques de diccionario, que introduce un retraso de 5 segundos durante la configuraci\u00f3n de la sesi\u00f3n, puede eludirse mediante solicitudes as\u00edncronas. Esta elusi\u00f3n invalida la protecci\u00f3n anti-fuerza bruta prevista, lo que podr\u00eda permitir a los atacantes realizar ataques de diccionario de forma m\u00e1s eficiente contra las credenciales de usuario u otros mecanismos de autenticaci\u00f3n." } ], "metrics": { diff --git a/CVE-2023/CVE-2023-380xx/CVE-2023-38035.json b/CVE-2023/CVE-2023-380xx/CVE-2023-38035.json index c148ec64221..2cb33cc6779 100644 --- a/CVE-2023/CVE-2023-380xx/CVE-2023-38035.json +++ b/CVE-2023/CVE-2023-380xx/CVE-2023-38035.json @@ -8,7 +8,7 @@ "descriptions": [ { "lang": "en", - "value": "A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. " + "value": "A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration." }, { "lang": "es", diff --git a/CVE-2023/CVE-2023-421xx/CVE-2023-42121.json b/CVE-2023/CVE-2023-421xx/CVE-2023-42121.json index 7d68e2d7b2e..41f62d9641e 100644 --- a/CVE-2023/CVE-2023-421xx/CVE-2023-42121.json +++ b/CVE-2023/CVE-2023-421xx/CVE-2023-42121.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo de autenticaci\u00f3n faltante en el panel web de control. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en las instalaciones afectadas de Control Web Panel. No se requiere autenticaci\u00f3n para aprovechar esta vulnerabilidad. La falla espec\u00edfica existe en la implementaci\u00f3n de la autenticaci\u00f3n dentro de la interfaz web. El problema se debe a la falta de autenticaci\u00f3n antes de permitir el acceso a la funcionalidad. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto de un usuario de CWP v\u00e1lido. Era ZDI-CAN-20582." + "value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo de autenticaci\u00f3n faltante en Control Web Panel. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en las instalaciones afectadas de Control Web Panel. No se requiere autenticaci\u00f3n para aprovechar esta vulnerabilidad. La falla espec\u00edfica existe en la implementaci\u00f3n de la autenticaci\u00f3n dentro de la interfaz web. El problema se debe a la falta de autenticaci\u00f3n antes de permitir el acceso a la funcionalidad. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto de un usuario de CWP v\u00e1lido. Era ZDI-CAN-20582." } ], "metrics": { diff --git a/CVE-2023/CVE-2023-465xx/CVE-2023-46566.json b/CVE-2023/CVE-2023-465xx/CVE-2023-46566.json index 91cb5c545ab..04f689d523c 100644 --- a/CVE-2023/CVE-2023-465xx/CVE-2023-46566.json +++ b/CVE-2023/CVE-2023-465xx/CVE-2023-46566.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Vulnerabilidad de desbordamiento de b\u00fafer en el commit tftpy de msoulier 467017b844bf6e31745138a30e2509145b0c529c permite a un atacante remoto provocar una denegaci\u00f3n de servicio a trav\u00e9s de la funci\u00f3n de an\u00e1lisis en la clase TftpPacketFactory." + "value": "Vulnerabilidad de desbordamiento de b\u00fafer en el commit tftpy de msoulier 467017b844bf6e31745138a30e2509145b0c529c permite a un atacante remoto provocar una denegaci\u00f3n de servicio a trav\u00e9s de la funci\u00f3n de an\u00e1lisis en la clase TftpPacketFactory" } ], "metrics": { diff --git a/CVE-2023/CVE-2023-473xx/CVE-2023-47363.json b/CVE-2023/CVE-2023-473xx/CVE-2023-47363.json index f99a9104a2e..78b973acbbe 100644 --- a/CVE-2023/CVE-2023-473xx/CVE-2023-47363.json +++ b/CVE-2023/CVE-2023-473xx/CVE-2023-47363.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "La fuga del token de acceso al canal en la l\u00ednea 13.6.1 de los miembros de FBP permite a atacantes remotos enviar notificaciones maliciosas a las v\u00edctimas." + "value": "La fuga del token de acceso al canal en Line 13.6.1 de los miembros de FBP permite a atacantes remotos enviar notificaciones maliciosas a las v\u00edctimas." } ], "metrics": { diff --git a/CVE-2023/CVE-2023-473xx/CVE-2023-47364.json b/CVE-2023/CVE-2023-473xx/CVE-2023-47364.json index 9db0b4cfddd..8df3bf633b8 100644 --- a/CVE-2023/CVE-2023-473xx/CVE-2023-47364.json +++ b/CVE-2023/CVE-2023-473xx/CVE-2023-47364.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "La fuga del token de acceso al canal en la l\u00ednea 13.6.1 del taxi de Nagaoka permite a atacantes remotos enviar notificaciones maliciosas a las v\u00edctimas" + "value": "La fuga del token de acceso al canal en Line 13.6.1 del taxi de Nagaoka permite a atacantes remotos enviar notificaciones maliciosas a las v\u00edctimas" } ], "metrics": { diff --git a/CVE-2023/CVE-2023-487xx/CVE-2023-48788.json b/CVE-2023/CVE-2023-487xx/CVE-2023-48788.json index 143f61fad87..53da9f128ce 100644 --- a/CVE-2023/CVE-2023-487xx/CVE-2023-48788.json +++ b/CVE-2023/CVE-2023-487xx/CVE-2023-48788.json @@ -66,7 +66,7 @@ "weaknesses": [ { "source": "psirt@fortinet.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2023/CVE-2023-504xx/CVE-2023-50434.json b/CVE-2023/CVE-2023-504xx/CVE-2023-50434.json index 05743d6e45a..25fc31ef989 100644 --- a/CVE-2023/CVE-2023-504xx/CVE-2023-50434.json +++ b/CVE-2023/CVE-2023-504xx/CVE-2023-50434.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "emdns_resolve_raw en emdns.c en emdns a trav\u00e9s de fbd1eef llama a strlen con una entrada que puede no estar terminada en '\\0', lo que provoca una sobrelectura del b\u00fafer basado en pila. Esto puede ser provocado por un adversario remoto que puede enviar solicitudes DNS al servidor emdns. El impacto podr\u00eda variar seg\u00fan las librer\u00edas del sistema, el compilador y la arquitectura del procesador. El c\u00f3digo anterior a be565c3 no se ve afectado." + "value": "emdnsemdns_resolve_raw en emdns.c en emdns a trav\u00e9s de fbd1eef llama a strlen con una entrada que puede no estar terminada en '\\0', lo que provoca una sobrelectura del b\u00fafer basado en pila. Esto puede ser provocado por un adversario remoto que puede enviar solicitudes DNS al servidor emdns. El impacto podr\u00eda variar seg\u00fan las librer\u00edas del sistema, el compilador y la arquitectura del procesador. El c\u00f3digo anterior a be565c3 no se ve afectado." } ], "metrics": { diff --git a/CVE-2023/CVE-2023-531xx/CVE-2023-53156.json b/CVE-2023/CVE-2023-531xx/CVE-2023-53156.json index dcec62007ee..6aa645bef7c 100644 --- a/CVE-2023/CVE-2023-531xx/CVE-2023-53156.json +++ b/CVE-2023/CVE-2023-531xx/CVE-2023-53156.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-27T21:15:25.687", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2023/CVE-2023-531xx/CVE-2023-53157.json b/CVE-2023/CVE-2023-531xx/CVE-2023-53157.json index c01b234dabd..2d052f10281 100644 --- a/CVE-2023/CVE-2023-531xx/CVE-2023-53157.json +++ b/CVE-2023/CVE-2023-531xx/CVE-2023-53157.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-28T00:15:25.253", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2023/CVE-2023-531xx/CVE-2023-53159.json b/CVE-2023/CVE-2023-531xx/CVE-2023-53159.json index c825ec8bfb8..07998019f3e 100644 --- a/CVE-2023/CVE-2023-531xx/CVE-2023-53159.json +++ b/CVE-2023/CVE-2023-531xx/CVE-2023-53159.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-28T03:15:23.193", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2023/CVE-2023-531xx/CVE-2023-53160.json b/CVE-2023/CVE-2023-531xx/CVE-2023-53160.json index 0c3fedefeea..6a9715e0ae7 100644 --- a/CVE-2023/CVE-2023-531xx/CVE-2023-53160.json +++ b/CVE-2023/CVE-2023-531xx/CVE-2023-53160.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-28T03:15:23.373", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2023/CVE-2023-531xx/CVE-2023-53161.json b/CVE-2023/CVE-2023-531xx/CVE-2023-53161.json index 753c5327f1a..75375c6728f 100644 --- a/CVE-2023/CVE-2023-531xx/CVE-2023-53161.json +++ b/CVE-2023/CVE-2023-531xx/CVE-2023-53161.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-28T03:15:23.557", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2023/CVE-2023-62xx/CVE-2023-6240.json b/CVE-2023/CVE-2023-62xx/CVE-2023-6240.json index 6b0d5282b36..7d78414dad2 100644 --- a/CVE-2023/CVE-2023-62xx/CVE-2023-6240.json +++ b/CVE-2023/CVE-2023-62xx/CVE-2023-6240.json @@ -62,7 +62,7 @@ "weaknesses": [ { "source": "secalert@redhat.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2023/CVE-2023-63xx/CVE-2023-6356.json b/CVE-2023/CVE-2023-63xx/CVE-2023-6356.json index 5117e64352c..dbdb80e6db1 100644 --- a/CVE-2023/CVE-2023-63xx/CVE-2023-6356.json +++ b/CVE-2023/CVE-2023-63xx/CVE-2023-6356.json @@ -62,7 +62,7 @@ "weaknesses": [ { "source": "secalert@redhat.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2023/CVE-2023-65xx/CVE-2023-6535.json b/CVE-2023/CVE-2023-65xx/CVE-2023-6535.json index b92d33f2db3..11d77ae8832 100644 --- a/CVE-2023/CVE-2023-65xx/CVE-2023-6535.json +++ b/CVE-2023/CVE-2023-65xx/CVE-2023-6535.json @@ -62,7 +62,7 @@ "weaknesses": [ { "source": "secalert@redhat.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2023/CVE-2023-65xx/CVE-2023-6536.json b/CVE-2023/CVE-2023-65xx/CVE-2023-6536.json index e2e46c6b631..127680ebce4 100644 --- a/CVE-2023/CVE-2023-65xx/CVE-2023-6536.json +++ b/CVE-2023/CVE-2023-65xx/CVE-2023-6536.json @@ -62,7 +62,7 @@ "weaknesses": [ { "source": "secalert@redhat.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2023/CVE-2023-73xx/CVE-2023-7306.json b/CVE-2023/CVE-2023-73xx/CVE-2023-7306.json index 8e204113beb..1168876648e 100644 --- a/CVE-2023/CVE-2023-73xx/CVE-2023-7306.json +++ b/CVE-2023/CVE-2023-73xx/CVE-2023-7306.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfm_delete_multiple_files() function in all versions up to, and including, 21.5. This makes it possible for unauthenticated attackers to delete arbitrary posts." + }, + { + "lang": "es", + "value": "El complemento Frontend File Manager Plugin para WordPress es vulnerable a la p\u00e9rdida no autorizada de datos debido a la falta de comprobaci\u00f3n de la funci\u00f3n wpfm_delete_multiple_files() en todas las versiones hasta la 21.5 incluida. Esto permite que atacantes no autenticados eliminen publicaciones arbitrarias." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-06xx/CVE-2024-0646.json b/CVE-2024/CVE-2024-06xx/CVE-2024-0646.json index 472ba2e074a..5116f367c25 100644 --- a/CVE-2024/CVE-2024-06xx/CVE-2024-0646.json +++ b/CVE-2024/CVE-2024-06xx/CVE-2024-0646.json @@ -62,7 +62,7 @@ "weaknesses": [ { "source": "secalert@redhat.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-111xx/CVE-2024-11120.json b/CVE-2024/CVE-2024-111xx/CVE-2024-11120.json index f8c369bda48..b03df9d1db2 100644 --- a/CVE-2024/CVE-2024-111xx/CVE-2024-11120.json +++ b/CVE-2024/CVE-2024-111xx/CVE-2024-11120.json @@ -73,7 +73,7 @@ "weaknesses": [ { "source": "twcert@cert.org.tw", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-116xx/CVE-2024-11667.json b/CVE-2024/CVE-2024-116xx/CVE-2024-11667.json index 8443d062f07..baf9aa1a162 100644 --- a/CVE-2024/CVE-2024-116xx/CVE-2024-11667.json +++ b/CVE-2024/CVE-2024-116xx/CVE-2024-11667.json @@ -66,7 +66,7 @@ "weaknesses": [ { "source": "security@zyxel.com.tw", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-123xx/CVE-2024-12310.json b/CVE-2024/CVE-2024-123xx/CVE-2024-12310.json index fe5d5c29c69..096a0364fd0 100644 --- a/CVE-2024/CVE-2024-123xx/CVE-2024-12310.json +++ b/CVE-2024/CVE-2024-123xx/CVE-2024-12310.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A vulnerability in Imprivata Enterprise Access Management\u00a0(formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk workstation and allows unauthorized access to the underlying Windows system through the already logged-in autologon account due to insufficient handling of keyboard shortcuts.\nThis issue affects Imprivata Enterprise Access Management versions 5.3 through 24.2." + }, + { + "lang": "es", + "value": "Una vulnerabilidad en Imprivata Enterprise Access Management (formerly Imprivata OneSign) permite omitir la pantalla de inicio de sesi\u00f3n de la estaci\u00f3n de trabajo compartida y permite el acceso no autorizado al sistema Windows subyacente a trav\u00e9s de la cuenta de inicio de sesi\u00f3n autom\u00e1tico ya iniciada debido a la gesti\u00f3n insuficiente de los atajos de teclado. Este problema afecta a las versiones 5.3 a 24.2 de Imprivata Enterprise Access Management." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-17xx/CVE-2024-1709.json b/CVE-2024/CVE-2024-17xx/CVE-2024-1709.json index c1504990090..ce69598ebe0 100644 --- a/CVE-2024/CVE-2024-17xx/CVE-2024-1709.json +++ b/CVE-2024/CVE-2024-17xx/CVE-2024-1709.json @@ -163,6 +163,7 @@ "url": "https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "tags": [ + "Exploit", "Third Party Advisory" ] }, diff --git a/CVE-2024/CVE-2024-202xx/CVE-2024-20257.json b/CVE-2024/CVE-2024-202xx/CVE-2024-20257.json index e61316e7416..20e63897497 100644 --- a/CVE-2024/CVE-2024-202xx/CVE-2024-20257.json +++ b/CVE-2024/CVE-2024-202xx/CVE-2024-20257.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-05-15T18:15:08.967", "lastModified": "2024-11-21T08:52:07.650", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-202xx/CVE-2024-20276.json b/CVE-2024/CVE-2024-202xx/CVE-2024-20276.json index 829f28868d0..d72d37f07c4 100644 --- a/CVE-2024/CVE-2024-202xx/CVE-2024-20276.json +++ b/CVE-2024/CVE-2024-202xx/CVE-2024-20276.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-03-27T17:15:51.513", "lastModified": "2024-11-21T08:52:12.480", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-203xx/CVE-2024-20330.json b/CVE-2024/CVE-2024-203xx/CVE-2024-20330.json index 0ec7d9c796d..8ebe1eeaaad 100644 --- a/CVE-2024/CVE-2024-203xx/CVE-2024-20330.json +++ b/CVE-2024/CVE-2024-203xx/CVE-2024-20330.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-10-23T17:15:17.663", "lastModified": "2024-10-25T12:56:36.827", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-203xx/CVE-2024-20339.json b/CVE-2024/CVE-2024-203xx/CVE-2024-20339.json index 60376826415..cfe83cd4377 100644 --- a/CVE-2024/CVE-2024-203xx/CVE-2024-20339.json +++ b/CVE-2024/CVE-2024-203xx/CVE-2024-20339.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-10-23T17:15:18.097", "lastModified": "2024-10-25T12:56:36.827", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-203xx/CVE-2024-20342.json b/CVE-2024/CVE-2024-203xx/CVE-2024-20342.json index 776a9abc4b2..be9ea4bdaa7 100644 --- a/CVE-2024/CVE-2024-203xx/CVE-2024-20342.json +++ b/CVE-2024/CVE-2024-203xx/CVE-2024-20342.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-10-23T17:15:18.703", "lastModified": "2025-01-13T18:15:17.057", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-203xx/CVE-2024-20351.json b/CVE-2024/CVE-2024-203xx/CVE-2024-20351.json index cd883584ff4..ca4103046a4 100644 --- a/CVE-2024/CVE-2024-203xx/CVE-2024-20351.json +++ b/CVE-2024/CVE-2024-203xx/CVE-2024-20351.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-10-23T17:15:18.913", "lastModified": "2024-10-25T12:56:36.827", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-203xx/CVE-2024-20392.json b/CVE-2024/CVE-2024-203xx/CVE-2024-20392.json index b2a78785e2f..a75c24dff67 100644 --- a/CVE-2024/CVE-2024-203xx/CVE-2024-20392.json +++ b/CVE-2024/CVE-2024-203xx/CVE-2024-20392.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-05-15T18:15:10.390", "lastModified": "2024-11-21T08:52:32.110", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-203xx/CVE-2024-20394.json b/CVE-2024/CVE-2024-203xx/CVE-2024-20394.json index f41c24936d1..397a669bd54 100644 --- a/CVE-2024/CVE-2024-203xx/CVE-2024-20394.json +++ b/CVE-2024/CVE-2024-203xx/CVE-2024-20394.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-05-15T18:15:10.620", "lastModified": "2024-11-21T08:52:32.420", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-204xx/CVE-2024-20429.json b/CVE-2024/CVE-2024-204xx/CVE-2024-20429.json index b1ed032d1ec..e3045fdc105 100644 --- a/CVE-2024/CVE-2024-204xx/CVE-2024-20429.json +++ b/CVE-2024/CVE-2024-204xx/CVE-2024-20429.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-07-17T17:15:14.497", "lastModified": "2024-11-21T08:52:36.500", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-204xx/CVE-2024-20457.json b/CVE-2024/CVE-2024-204xx/CVE-2024-20457.json index 8c421144fa7..f2848aa4a9c 100644 --- a/CVE-2024/CVE-2024-204xx/CVE-2024-20457.json +++ b/CVE-2024/CVE-2024-204xx/CVE-2024-20457.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-06T17:15:15.107", "lastModified": "2024-11-06T18:17:17.287", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-205xx/CVE-2024-20511.json b/CVE-2024/CVE-2024-205xx/CVE-2024-20511.json index 9a7f65876dd..aa1a225e844 100644 --- a/CVE-2024/CVE-2024-205xx/CVE-2024-20511.json +++ b/CVE-2024/CVE-2024-205xx/CVE-2024-20511.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-06T17:15:16.467", "lastModified": "2024-11-06T18:17:17.287", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-205xx/CVE-2024-20512.json b/CVE-2024/CVE-2024-205xx/CVE-2024-20512.json index 24e47939af7..9dfa9736040 100644 --- a/CVE-2024/CVE-2024-205xx/CVE-2024-20512.json +++ b/CVE-2024/CVE-2024-205xx/CVE-2024-20512.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-10-16T17:15:15.913", "lastModified": "2024-10-18T12:53:04.627", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-205xx/CVE-2024-20540.json b/CVE-2024/CVE-2024-205xx/CVE-2024-20540.json index 3f30aef3c8e..8fe9974d7b2 100644 --- a/CVE-2024/CVE-2024-205xx/CVE-2024-20540.json +++ b/CVE-2024/CVE-2024-205xx/CVE-2024-20540.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2024-11-06T17:15:19.977", "lastModified": "2024-11-06T18:17:17.287", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-207xx/CVE-2024-20767.json b/CVE-2024/CVE-2024-207xx/CVE-2024-20767.json index be87144ebca..05bbb51668e 100644 --- a/CVE-2024/CVE-2024-207xx/CVE-2024-20767.json +++ b/CVE-2024/CVE-2024-207xx/CVE-2024-20767.json @@ -19,7 +19,7 @@ "cvssMetricV31": [ { "source": "psirt@adobe.com", - "type": "Primary", + "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", diff --git a/CVE-2024/CVE-2024-209xx/CVE-2024-20953.json b/CVE-2024/CVE-2024-209xx/CVE-2024-20953.json index 7ac7ccd2f33..3a682591103 100644 --- a/CVE-2024/CVE-2024-209xx/CVE-2024-20953.json +++ b/CVE-2024/CVE-2024-209xx/CVE-2024-20953.json @@ -19,7 +19,7 @@ "cvssMetricV31": [ { "source": "secalert_us@oracle.com", - "type": "Primary", + "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", diff --git a/CVE-2024/CVE-2024-217xx/CVE-2024-21762.json b/CVE-2024/CVE-2024-217xx/CVE-2024-21762.json index 234360d1cb4..4407ad3d4cb 100644 --- a/CVE-2024/CVE-2024-217xx/CVE-2024-21762.json +++ b/CVE-2024/CVE-2024-217xx/CVE-2024-21762.json @@ -66,7 +66,7 @@ "weaknesses": [ { "source": "psirt@fortinet.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-231xx/CVE-2024-23113.json b/CVE-2024/CVE-2024-231xx/CVE-2024-23113.json index d77bd6e28e8..b7bcfba1ea7 100644 --- a/CVE-2024/CVE-2024-231xx/CVE-2024-23113.json +++ b/CVE-2024/CVE-2024-231xx/CVE-2024-23113.json @@ -66,7 +66,7 @@ "weaknesses": [ { "source": "psirt@fortinet.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-238xx/CVE-2024-23823.json b/CVE-2024/CVE-2024-238xx/CVE-2024-23823.json index 4e161ed2269..44fa83dc4ea 100644 --- a/CVE-2024/CVE-2024-238xx/CVE-2024-23823.json +++ b/CVE-2024/CVE-2024-238xx/CVE-2024-23823.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2024-03-14T19:15:49.560", "lastModified": "2024-11-21T08:58:29.780", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-243xx/CVE-2024-24336.json b/CVE-2024/CVE-2024-243xx/CVE-2024-24336.json index a0a0d932310..72d89aa3088 100644 --- a/CVE-2024/CVE-2024-243xx/CVE-2024-24336.json +++ b/CVE-2024/CVE-2024-243xx/CVE-2024-24336.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Una vulnerabilidad de Cross-Site Scripting (XSS) m\u00faltiple en los endpoints '/members/moremember.pl' y '/members/members-home.pl' dentro de Koha Library Management System versi\u00f3n 23.05.05 y anteriores permite que usuarios malintencionados del personal lleven realizar ataques CSRF, incluidos cambios no autorizados en los nombres de usuario y contrase\u00f1as de los usuarios que visitan la p\u00e1gina afectada, a trav\u00e9s de los componentes 'Nota de circulaci\u00f3n' y 'Restricci\u00f3n de usuarios'." + "value": "A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and \u2018/members/members-home.pl\u2019 endpoints within Koha Library Management System version 23.05.05 and earlier allows malicious staff users to carry out CSRF attacks, including unauthorized changes to usernames and passwords of users visiting the affected page, via the 'Circulation note' and \u2018Patrons Restriction\u2019 components." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-245xx/CVE-2024-24562.json b/CVE-2024/CVE-2024-245xx/CVE-2024-24562.json index e0096785f8f..769af27ecfd 100644 --- a/CVE-2024/CVE-2024-245xx/CVE-2024-24562.json +++ b/CVE-2024/CVE-2024-245xx/CVE-2024-24562.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2024-03-14T19:15:49.767", "lastModified": "2024-11-21T08:59:25.580", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-254xx/CVE-2024-25458.json b/CVE-2024/CVE-2024-254xx/CVE-2024-25458.json index 48c9b387196..e84808848cd 100644 --- a/CVE-2024/CVE-2024-254xx/CVE-2024-25458.json +++ b/CVE-2024/CVE-2024-254xx/CVE-2024-25458.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Un problema en el firmware de la c\u00e1mara CYCZCAM, SHIX ZHAO, SHIXCAM A9 (identificador de placa de circuito A9-48B-V1.0) v.CYCAM_48B_BC01_v87_0903 permite a un atacante remoto obtener informaci\u00f3n confidencial a trav\u00e9s de una solicitud manipulada a un puerto UDP." + "value": "Un problema en el firmware de CYCZCAM, SHIX ZHAO, SHIXCAM A9 Camera (identificador de placa de circuito A9-48B-V1.0) v.CYCAM_48B_BC01_v87_0903 permite a un atacante remoto obtener informaci\u00f3n confidencial a trav\u00e9s de una solicitud manipulada a un puerto UDP." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-26xx/CVE-2024-2698.json b/CVE-2024/CVE-2024-26xx/CVE-2024-2698.json index 6470965c721..cb049f14b89 100644 --- a/CVE-2024/CVE-2024-26xx/CVE-2024-2698.json +++ b/CVE-2024/CVE-2024-26xx/CVE-2024-2698.json @@ -19,7 +19,7 @@ "cvssMetricV31": [ { "source": "secalert@redhat.com", - "type": "Primary", + "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", @@ -62,7 +62,7 @@ "weaknesses": [ { "source": "secalert@redhat.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-272xx/CVE-2024-27238.json b/CVE-2024/CVE-2024-272xx/CVE-2024-27238.json index 149cae9758b..3fcf186db06 100644 --- a/CVE-2024/CVE-2024-272xx/CVE-2024-27238.json +++ b/CVE-2024/CVE-2024-272xx/CVE-2024-27238.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2024-07-15T18:15:03.633", "lastModified": "2024-11-21T09:04:10.813", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-272xx/CVE-2024-27240.json b/CVE-2024/CVE-2024-272xx/CVE-2024-27240.json index 9510a38d0ca..05e1acece78 100644 --- a/CVE-2024/CVE-2024-272xx/CVE-2024-27240.json +++ b/CVE-2024/CVE-2024-272xx/CVE-2024-27240.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2024-07-15T18:15:03.873", "lastModified": "2024-11-21T09:04:10.943", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-277xx/CVE-2024-27756.json b/CVE-2024/CVE-2024-277xx/CVE-2024-27756.json index 673df22ec37..3ae85e58aeb 100644 --- a/CVE-2024/CVE-2024-277xx/CVE-2024-27756.json +++ b/CVE-2024/CVE-2024-277xx/CVE-2024-27756.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2024-03-15T07:15:09.923", "lastModified": "2024-11-21T09:04:59.863", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-288xx/CVE-2024-28866.json b/CVE-2024/CVE-2024-288xx/CVE-2024-28866.json index 757ffd901d2..dfd44e4f553 100644 --- a/CVE-2024/CVE-2024-288xx/CVE-2024-28866.json +++ b/CVE-2024/CVE-2024-288xx/CVE-2024-28866.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2024-05-14T15:14:46.727", "lastModified": "2024-11-21T09:07:04.453", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-289xx/CVE-2024-28986.json b/CVE-2024/CVE-2024-289xx/CVE-2024-28986.json index 8f8bc732187..f034e1ddb51 100644 --- a/CVE-2024/CVE-2024-289xx/CVE-2024-28986.json +++ b/CVE-2024/CVE-2024-289xx/CVE-2024-28986.json @@ -19,7 +19,7 @@ "cvssMetricV31": [ { "source": "psirt@solarwinds.com", - "type": "Primary", + "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", @@ -46,7 +46,7 @@ "weaknesses": [ { "source": "psirt@solarwinds.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-289xx/CVE-2024-28987.json b/CVE-2024/CVE-2024-289xx/CVE-2024-28987.json index ac7a81f6c68..f87a29a399d 100644 --- a/CVE-2024/CVE-2024-289xx/CVE-2024-28987.json +++ b/CVE-2024/CVE-2024-289xx/CVE-2024-28987.json @@ -66,7 +66,7 @@ "weaknesses": [ { "source": "psirt@solarwinds.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-289xx/CVE-2024-28995.json b/CVE-2024/CVE-2024-289xx/CVE-2024-28995.json index 70c40fcde4c..6319569bc4d 100644 --- a/CVE-2024/CVE-2024-289xx/CVE-2024-28995.json +++ b/CVE-2024/CVE-2024-289xx/CVE-2024-28995.json @@ -66,7 +66,7 @@ "weaknesses": [ { "source": "psirt@solarwinds.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-319xx/CVE-2024-31963.json b/CVE-2024/CVE-2024-319xx/CVE-2024-31963.json index 72ea49d4dc4..e54444e0e54 100644 --- a/CVE-2024/CVE-2024-319xx/CVE-2024-31963.json +++ b/CVE-2024/CVE-2024-319xx/CVE-2024-31963.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Una vulnerabilidad en los tel\u00e9fonos SIP Mitel de las series 6800 y 6900, incluida la unidad de conferencia 6970, hasta 6.3 SP3 HF4, permite a un atacante autenticado llevar a cabo un ataque de desbordamiento del b\u00fafer debido a una comprobaci\u00f3n de los l\u00edmites y una sanitizaci\u00f3n de entrada insuficientes. Un exploit exitoso podr\u00eda permitir que un atacante provoque una denegaci\u00f3n de servicio." + "value": "Una vulnerabilidad en los tel\u00e9fonos SIP Mitel de las series 6800 y 6900, incluida la unidad de conferencia 6970, hasta 6.3 SP3 HF4, permite a un atacante autenticado llevar a cabo un ataque de desbordamiento del b\u00fafer debido a una comprobaci\u00f3n de los l\u00edmites y una depuraci\u00f3n de entrada insuficientes. Un exploit exitoso podr\u00eda permitir que un atacante provoque una denegaci\u00f3n de servicio." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-319xx/CVE-2024-31966.json b/CVE-2024/CVE-2024-319xx/CVE-2024-31966.json index 092ca8dbc08..e9370080537 100644 --- a/CVE-2024/CVE-2024-319xx/CVE-2024-31966.json +++ b/CVE-2024/CVE-2024-319xx/CVE-2024-31966.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Una vulnerabilidad en los tel\u00e9fonos SIP Mitel de las series 6800 y 6900, incluida la unidad de conferencia 6970, hasta 6.3 SP3 HF4, permite a un atacante autenticado con privilegios administrativos realizar un ataque de inyecci\u00f3n de argumentos debido a una sanitizaci\u00f3n insuficiente de los par\u00e1metros. Un exploit exitoso podr\u00eda permitir a un atacante acceder a informaci\u00f3n confidencial, modificar la configuraci\u00f3n del sistema o ejecutar comandos arbitrarios." + "value": "Una vulnerabilidad en los tel\u00e9fonos SIP Mitel de las series 6800 y 6900, incluida la unidad de conferencia 6970, hasta 6.3 SP3 HF4, permite a un atacante autenticado con privilegios administrativos realizar un ataque de inyecci\u00f3n de argumentos debido a una depuraci\u00f3n insuficiente de los par\u00e1metros. Un exploit exitoso podr\u00eda permitir a un atacante acceder a informaci\u00f3n confidencial, modificar la configuraci\u00f3n del sistema o ejecutar comandos arbitrarios." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-321xx/CVE-2024-32113.json b/CVE-2024/CVE-2024-321xx/CVE-2024-32113.json index a7a438a1084..965973af684 100644 --- a/CVE-2024/CVE-2024-321xx/CVE-2024-32113.json +++ b/CVE-2024/CVE-2024-321xx/CVE-2024-32113.json @@ -66,7 +66,7 @@ "weaknesses": [ { "source": "security@apache.org", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-336xx/CVE-2024-33625.json b/CVE-2024/CVE-2024-336xx/CVE-2024-33625.json index 120164d9e6a..a25283a54bc 100644 --- a/CVE-2024/CVE-2024-336xx/CVE-2024-33625.json +++ b/CVE-2024/CVE-2024-336xx/CVE-2024-33625.json @@ -3,7 +3,7 @@ "sourceIdentifier": "ics-cert@hq.dhs.gov", "published": "2024-05-15T20:15:12.927", "lastModified": "2024-11-21T09:17:16.207", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-340xx/CVE-2024-34025.json b/CVE-2024/CVE-2024-340xx/CVE-2024-34025.json index 65d79db78b3..f9c8a0c8c26 100644 --- a/CVE-2024/CVE-2024-340xx/CVE-2024-34025.json +++ b/CVE-2024/CVE-2024-340xx/CVE-2024-34025.json @@ -3,7 +3,7 @@ "sourceIdentifier": "ics-cert@hq.dhs.gov", "published": "2024-05-15T20:15:13.190", "lastModified": "2024-11-21T09:17:56.273", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-340xx/CVE-2024-34074.json b/CVE-2024/CVE-2024-340xx/CVE-2024-34074.json index 77e1495393b..d2b9adf56e1 100644 --- a/CVE-2024/CVE-2024-340xx/CVE-2024-34074.json +++ b/CVE-2024/CVE-2024-340xx/CVE-2024-34074.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2024-05-14T15:38:27.850", "lastModified": "2024-11-21T09:18:02.237", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-341xx/CVE-2024-34102.json b/CVE-2024/CVE-2024-341xx/CVE-2024-34102.json index 47675f25ac6..a3a6e2dbac9 100644 --- a/CVE-2024/CVE-2024-341xx/CVE-2024-34102.json +++ b/CVE-2024/CVE-2024-341xx/CVE-2024-34102.json @@ -19,7 +19,7 @@ "cvssMetricV31": [ { "source": "psirt@adobe.com", - "type": "Primary", + "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", @@ -46,7 +46,7 @@ "weaknesses": [ { "source": "psirt@adobe.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-343xx/CVE-2024-34327.json b/CVE-2024/CVE-2024-343xx/CVE-2024-34327.json index ba27b24672c..def612a340c 100644 --- a/CVE-2024/CVE-2024-343xx/CVE-2024-34327.json +++ b/CVE-2024/CVE-2024-343xx/CVE-2024-34327.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-31T17:15:29.937", "lastModified": "2025-07-31T20:15:30.790", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 que Sielox AnyWare v2.1.2 conten\u00eda una vulnerabilidad de inyecci\u00f3n SQL a trav\u00e9s del campo de direcci\u00f3n de correo electr\u00f3nico del formulario de restablecimiento de contrase\u00f1a." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-343xx/CVE-2024-34328.json b/CVE-2024/CVE-2024-343xx/CVE-2024-34328.json index 92b9dda494a..bf635551344 100644 --- a/CVE-2024/CVE-2024-343xx/CVE-2024-34328.json +++ b/CVE-2024/CVE-2024-343xx/CVE-2024-34328.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL." + }, + { + "lang": "es", + "value": "Una redirecci\u00f3n abierta en Sielox AnyWare v2.1.2 permite a los atacantes ejecutar un ataque de intermediario a trav\u00e9s de una URL manipulada espec\u00edficamente para ello." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-384xx/CVE-2024-38443.json b/CVE-2024/CVE-2024-384xx/CVE-2024-38443.json index a806aab66c9..6747915f4ef 100644 --- a/CVE-2024/CVE-2024-384xx/CVE-2024-38443.json +++ b/CVE-2024/CVE-2024-384xx/CVE-2024-38443.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "C/sorting/binary_insertion_sort.c en Los algoritmos: C hasta e5dad3f tiene un error de segmentaci\u00f3n para la recursividad profunda, lo que puede afectar casos de uso comunes, como ordenar una matriz de 50 elementos." + "value": "C/sorting/binary_insertion_sort.c en The Algorithms - C hasta e5dad3f tiene un error de segmentaci\u00f3n para la recursividad profunda, lo que puede afectar casos de uso comunes, como ordenar una matriz de 50 elementos." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-388xx/CVE-2024-38856.json b/CVE-2024/CVE-2024-388xx/CVE-2024-38856.json index c1839eeffed..d4d2bb9f209 100644 --- a/CVE-2024/CVE-2024-388xx/CVE-2024-38856.json +++ b/CVE-2024/CVE-2024-388xx/CVE-2024-38856.json @@ -66,7 +66,7 @@ "weaknesses": [ { "source": "security@apache.org", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-393xx/CVE-2024-39347.json b/CVE-2024/CVE-2024-393xx/CVE-2024-39347.json index 984ea479f34..7fcb84042bf 100644 --- a/CVE-2024/CVE-2024-393xx/CVE-2024-39347.json +++ b/CVE-2024/CVE-2024-393xx/CVE-2024-39347.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@synology.com", "published": "2024-06-28T07:15:05.743", "lastModified": "2024-11-21T09:27:31.230", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-393xx/CVE-2024-39348.json b/CVE-2024/CVE-2024-393xx/CVE-2024-39348.json index 4db6004ee2c..29008f8e65d 100644 --- a/CVE-2024/CVE-2024-393xx/CVE-2024-39348.json +++ b/CVE-2024/CVE-2024-393xx/CVE-2024-39348.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@synology.com", "published": "2024-06-28T07:15:06.043", "lastModified": "2024-11-21T09:27:31.367", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-398xx/CVE-2024-39819.json b/CVE-2024/CVE-2024-398xx/CVE-2024-39819.json index c159d8d1f38..22e46a146af 100644 --- a/CVE-2024/CVE-2024-398xx/CVE-2024-39819.json +++ b/CVE-2024/CVE-2024-398xx/CVE-2024-39819.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2024-07-15T18:15:04.407", "lastModified": "2024-11-21T09:28:23.293", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-398xx/CVE-2024-39820.json b/CVE-2024/CVE-2024-398xx/CVE-2024-39820.json index be9e6ccf3c4..50aa5e3256b 100644 --- a/CVE-2024/CVE-2024-398xx/CVE-2024-39820.json +++ b/CVE-2024/CVE-2024-398xx/CVE-2024-39820.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2024-07-15T18:15:04.620", "lastModified": "2024-11-21T09:28:23.430", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-398xx/CVE-2024-39821.json b/CVE-2024/CVE-2024-398xx/CVE-2024-39821.json index 8a8fe17d0d0..104101a99a4 100644 --- a/CVE-2024/CVE-2024-398xx/CVE-2024-39821.json +++ b/CVE-2024/CVE-2024-398xx/CVE-2024-39821.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2024-07-15T18:15:04.827", "lastModified": "2024-11-21T09:28:23.553", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-398xx/CVE-2024-39826.json b/CVE-2024/CVE-2024-398xx/CVE-2024-39826.json index 16661b1a274..bcf08296c86 100644 --- a/CVE-2024/CVE-2024-398xx/CVE-2024-39826.json +++ b/CVE-2024/CVE-2024-398xx/CVE-2024-39826.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2024-07-15T18:15:05.033", "lastModified": "2024-11-21T09:28:24.037", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-398xx/CVE-2024-39827.json b/CVE-2024/CVE-2024-398xx/CVE-2024-39827.json index e88107baa8c..dc4f2eed143 100644 --- a/CVE-2024/CVE-2024-398xx/CVE-2024-39827.json +++ b/CVE-2024/CVE-2024-398xx/CVE-2024-39827.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2024-07-15T18:15:05.237", "lastModified": "2024-11-21T09:28:24.157", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-406xx/CVE-2024-40682.json b/CVE-2024/CVE-2024-406xx/CVE-2024-40682.json index 0b11039c315..00a367a3943 100644 --- a/CVE-2024/CVE-2024-406xx/CVE-2024-40682.json +++ b/CVE-2024/CVE-2024-406xx/CVE-2024-40682.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local user to cause a denial of service due to improper validation of specified type of input." + }, + { + "lang": "es", + "value": "IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1 y 1.3.8.2 podr\u00edan permitir que un usuario local provoque una denegaci\u00f3n de servicio debido a una validaci\u00f3n incorrecta del tipo de entrada especificado." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-406xx/CVE-2024-40686.json b/CVE-2024/CVE-2024-406xx/CVE-2024-40686.json index 4f7461fdc0b..1c983e70adb 100644 --- a/CVE-2024/CVE-2024-406xx/CVE-2024-40686.json +++ b/CVE-2024/CVE-2024-406xx/CVE-2024-40686.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking." + }, + { + "lang": "es", + "value": "IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1 y 1.3.8.2 es vulnerable a la inyecci\u00f3n de encabezados HTTP, causada por una validaci\u00f3n incorrecta de la entrada en los encabezados HOST. Esto podr\u00eda permitir a un atacante realizar diversos ataques contra el sistema vulnerable, incluyendo cross-site scripting, envenenamiento de cach\u00e9 o secuestro de sesi\u00f3n." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-407xx/CVE-2024-40710.json b/CVE-2024/CVE-2024-407xx/CVE-2024-40710.json index 5773d61977e..44a032be447 100644 --- a/CVE-2024/CVE-2024-407xx/CVE-2024-40710.json +++ b/CVE-2024/CVE-2024-407xx/CVE-2024-40710.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Una serie de vulnerabilidades relacionadas de alta gravedad, la m\u00e1s notable de las cuales permite la ejecuci\u00f3n remota de c\u00f3digo (RCE) como cuenta de servicio y la extracci\u00f3n de informaci\u00f3n confidencial (credenciales y contrase\u00f1as guardadas). Para explotar estas vulnerabilidades se requiere un usuario al que se le haya asignado un rol con pocos privilegios dentro de Veeam Backup & Replication." + "value": "Una serie de vulnerabilidades relacionadas de alta gravedad, la m\u00e1s notable de las cuales permite la ejecuci\u00f3n remota de c\u00f3digo (RCE) como cuenta de servicio y la extracci\u00f3n de informaci\u00f3n confidencial (credenciales y contrase\u00f1as guardadas). Para explotar estas vulnerabilidades se requiere un usuario al que se le haya asignado un rol con pocos privilegios dentro de Veeam Backup & Replication" } ], "metrics": { diff --git a/CVE-2024/CVE-2024-40xx/CVE-2024-4067.json b/CVE-2024/CVE-2024-40xx/CVE-2024-4067.json index 08c2ec4d763..7efadbdf2cc 100644 --- a/CVE-2024/CVE-2024-40xx/CVE-2024-4067.json +++ b/CVE-2024/CVE-2024-40xx/CVE-2024-4067.json @@ -3,7 +3,7 @@ "sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "published": "2024-05-14T15:42:47.947", "lastModified": "2024-11-21T09:42:07.587", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-40xx/CVE-2024-4068.json b/CVE-2024/CVE-2024-40xx/CVE-2024-4068.json index 81d7f556864..634e7cc3448 100644 --- a/CVE-2024/CVE-2024-40xx/CVE-2024-4068.json +++ b/CVE-2024/CVE-2024-40xx/CVE-2024-4068.json @@ -3,7 +3,7 @@ "sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "published": "2024-05-14T15:42:48.660", "lastModified": "2024-11-21T09:42:07.710", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-417xx/CVE-2024-41750.json b/CVE-2024/CVE-2024-417xx/CVE-2024-41750.json index 6302afac0bf..7b7dba55644 100644 --- a/CVE-2024/CVE-2024-417xx/CVE-2024-41750.json +++ b/CVE-2024/CVE-2024-417xx/CVE-2024-41750.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of security to manipulate data." + }, + { + "lang": "es", + "value": "IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1 y 1.3.8.2 podr\u00edan permitir que un atacante local autenticado eluda la aplicaci\u00f3n de seguridad del lado del cliente para manipular datos." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-417xx/CVE-2024-41751.json b/CVE-2024/CVE-2024-417xx/CVE-2024-41751.json index 433e84107f5..afeb36d9d95 100644 --- a/CVE-2024/CVE-2024-417xx/CVE-2024-41751.json +++ b/CVE-2024/CVE-2024-417xx/CVE-2024-41751.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of security to manipulate data." + }, + { + "lang": "es", + "value": "IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1 y 1.3.8.2 podr\u00edan permitir que un atacante local autenticado eluda la aplicaci\u00f3n de seguridad del lado del cliente para manipular datos." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-420xx/CVE-2024-42023.json b/CVE-2024/CVE-2024-420xx/CVE-2024-42023.json index ccdc2eb34c1..00f07b91c14 100644 --- a/CVE-2024/CVE-2024-420xx/CVE-2024-42023.json +++ b/CVE-2024/CVE-2024-420xx/CVE-2024-42023.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Una vulnerabilidad de control de acceso inadecuado permite a usuarios con pocos privilegios ejecutar c\u00f3digo con privilegios de administrador de forma remota." + "value": "Una vulnerabilidad de control de acceso inadecuado permite a usuarios con pocos privilegios ejecutar c\u00f3digo con permisos de administrador de forma remota." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-424xx/CVE-2024-42423.json b/CVE-2024/CVE-2024-424xx/CVE-2024-42423.json index e54502c62b7..72f53c3b22a 100644 --- a/CVE-2024/CVE-2024-424xx/CVE-2024-42423.json +++ b/CVE-2024/CVE-2024-424xx/CVE-2024-42423.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security_alert@emc.com", "published": "2024-09-10T15:15:17.013", "lastModified": "2024-09-20T19:42:20.417", - "vulnStatus": "Undergoing Analysis", + "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-424xx/CVE-2024-42449.json b/CVE-2024/CVE-2024-424xx/CVE-2024-42449.json index 3af0d17fa20..2f74b4f8fa8 100644 --- a/CVE-2024/CVE-2024-424xx/CVE-2024-42449.json +++ b/CVE-2024/CVE-2024-424xx/CVE-2024-42449.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": " Desde la m\u00e1quina del agente de administraci\u00f3n de VSPC, siempre que el agente de administraci\u00f3n est\u00e9 autorizado en el servidor, es posible eliminar archivos arbitrarios en la m\u00e1quina del servidor de VSPC." + "value": "Desde la m\u00e1quina del agente de administraci\u00f3n de VSPC, siempre que el agente de administraci\u00f3n est\u00e9 autorizado en el servidor, es posible eliminar archivos arbitrarios en la m\u00e1quina del servidor de VSPC." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-430xx/CVE-2024-43047.json b/CVE-2024/CVE-2024-430xx/CVE-2024-43047.json index 5410004a737..2e8cf9f9e06 100644 --- a/CVE-2024/CVE-2024-430xx/CVE-2024-43047.json +++ b/CVE-2024/CVE-2024-430xx/CVE-2024-43047.json @@ -19,7 +19,7 @@ "cvssMetricV31": [ { "source": "product-security@qualcomm.com", - "type": "Primary", + "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", diff --git a/CVE-2024/CVE-2024-451xx/CVE-2024-45195.json b/CVE-2024/CVE-2024-451xx/CVE-2024-45195.json index 0d981568808..216a8b11bc2 100644 --- a/CVE-2024/CVE-2024-451xx/CVE-2024-45195.json +++ b/CVE-2024/CVE-2024-451xx/CVE-2024-45195.json @@ -66,7 +66,7 @@ "weaknesses": [ { "source": "security@apache.org", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-452xx/CVE-2024-45204.json b/CVE-2024/CVE-2024-452xx/CVE-2024-45204.json index 17dab7c26cd..622857e38ca 100644 --- a/CVE-2024/CVE-2024-452xx/CVE-2024-45204.json +++ b/CVE-2024/CVE-2024-452xx/CVE-2024-45204.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": " Existe una vulnerabilidad en la que un usuario con pocos privilegios puede aprovechar la falta de permisos en el manejo de credenciales para filtrar hashes NTLM de credenciales guardadas. La explotaci\u00f3n implica el uso de credenciales recuperadas para exponer hashes NTLM confidenciales, lo que afecta a sistemas m\u00e1s all\u00e1 del objetivo inicial y puede generar vulnerabilidades de seguridad m\u00e1s amplias." + "value": "Existe una vulnerabilidad en la que un usuario con pocos privilegios puede aprovechar la falta de permisos en el manejo de credenciales para filtrar hashes NTLM de credenciales guardadas. La explotaci\u00f3n implica el uso de credenciales recuperadas para exponer hashes NTLM confidenciales, lo que afecta a sistemas m\u00e1s all\u00e1 del objetivo inicial y puede generar vulnerabilidades de seguridad m\u00e1s amplias." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-454xx/CVE-2024-45413.json b/CVE-2024/CVE-2024-454xx/CVE-2024-45413.json index 87bb2f2eb64..2b3bc1d8f51 100644 --- a/CVE-2024/CVE-2024-454xx/CVE-2024-45413.json +++ b/CVE-2024/CVE-2024-454xx/CVE-2024-45413.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "El binario HTTPD en varios enrutadores ZTE tiene una vulnerabilidad de desbordamiento de b\u00fafer basada en pila en la funci\u00f3n rsa_decrypt. Esta funci\u00f3n es un contenedor de API para LUA para descifrar texto cifrado RSA; los datos descifrados se almacenan en la pila sin verificar su longitud. Un atacante autenticado puede obtener RCE como superusuario al explotar esta vulnerabilidad." + "value": "El binario HTTPD en varios ZTE routers tiene una vulnerabilidad de desbordamiento de b\u00fafer basada en pila en la funci\u00f3n rsa_decrypt. Esta funci\u00f3n es un contenedor de API para LUA para descifrar texto cifrado RSA; los datos descifrados se almacenan en la pila sin verificar su longitud. Un atacante autenticado puede obtener RCE como root al explotar esta vulnerabilidad." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-454xx/CVE-2024-45414.json b/CVE-2024/CVE-2024-454xx/CVE-2024-45414.json index 95942710b8d..c02ed6e3737 100644 --- a/CVE-2024/CVE-2024-454xx/CVE-2024-45414.json +++ b/CVE-2024/CVE-2024-454xx/CVE-2024-45414.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "El binario HTTPD en varios enrutadores ZTE tiene una vulnerabilidad de desbordamiento de b\u00fafer basada en pila en la funci\u00f3n webPrivateDecrypt. Esta funci\u00f3n es responsable de descifrar el texto cifrado RSA; los datos cifrados se suministran codificados en base64. El texto cifrado descodificado se almacena en la pila sin verificar su longitud. Un atacante no autenticado puede obtener RCE como superusuario explotando esta vulnerabilidad." + "value": "El binario HTTPD en varios ZTE routers tiene una vulnerabilidad de desbordamiento de b\u00fafer basada en pila en la funci\u00f3n webPrivateDecrypt. Esta funci\u00f3n es responsable de descifrar el texto cifrado RSA; los datos cifrados se suministran codificados en base64. El texto cifrado descodificado se almacena en la pila sin verificar su longitud. Un atacante no autenticado puede obtener RCE como superusuario explotando esta vulnerabilidad." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-454xx/CVE-2024-45415.json b/CVE-2024/CVE-2024-454xx/CVE-2024-45415.json index dfc1894b0c9..a97e099cc8b 100644 --- a/CVE-2024/CVE-2024-454xx/CVE-2024-45415.json +++ b/CVE-2024/CVE-2024-454xx/CVE-2024-45415.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "El binario HTTPD en varios enrutadores ZTE tiene una vulnerabilidad de desbordamiento de b\u00fafer basada en pila en la funci\u00f3n check_data_integrity. Esta funci\u00f3n es responsable de validar la suma de comprobaci\u00f3n de los datos en la solicitud posterior. La suma de comprobaci\u00f3n se env\u00eda cifrada en la solicitud, la funci\u00f3n la descifra y almacena la suma de comprobaci\u00f3n en la pila sin validarla. Un atacante no autenticado puede obtener RCE como superusuario explotando esta vulnerabilidad." + "value": "El binario HTTPD en varios ZTE routers tiene una vulnerabilidad de desbordamiento de b\u00fafer basada en pila en la funci\u00f3n check_data_integrity. Esta funci\u00f3n es responsable de validar la suma de comprobaci\u00f3n de los datos en la solicitud posterior. La suma de comprobaci\u00f3n se env\u00eda cifrada en la solicitud, la funci\u00f3n la descifra y almacena la suma de comprobaci\u00f3n en la pila sin validarla. Un atacante no autenticado puede obtener RCE como superusuario explotando esta vulnerabilidad." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-454xx/CVE-2024-45416.json b/CVE-2024/CVE-2024-454xx/CVE-2024-45416.json index 3453fde1090..1b8cd86fd87 100644 --- a/CVE-2024/CVE-2024-454xx/CVE-2024-45416.json +++ b/CVE-2024/CVE-2024-454xx/CVE-2024-45416.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "El binario HTTPD en varios enrutadores ZTE tiene una vulnerabilidad de inclusi\u00f3n de archivos locales en la funci\u00f3n session_init. Los archivos de sesi\u00f3n -LUA- se almacenan en el directorio /var/lua_session, la funci\u00f3n itera sobre todos los archivos de este directorio y los ejecuta utilizando la funci\u00f3n dofile sin ninguna validaci\u00f3n si es un archivo de sesi\u00f3n v\u00e1lido o no. Un atacante que pueda escribir un archivo malicioso en el directorio sessions puede obtener RCE como superusuario." + "value": "El binario HTTPD en varios ZTE routers tiene una vulnerabilidad de inclusi\u00f3n de archivos locales en la funci\u00f3n session_init. Los archivos de sesi\u00f3n -LUA- se almacenan en el directorio /var/lua_session, la funci\u00f3n itera sobre todos los archivos de este directorio y los ejecuta utilizando la funci\u00f3n dofile sin ninguna validaci\u00f3n si es un archivo de sesi\u00f3n v\u00e1lido o no. Un atacante que pueda escribir un archivo malicioso en el directorio sessions puede obtener RCE como superusuario." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-482xx/CVE-2024-48208.json b/CVE-2024/CVE-2024-482xx/CVE-2024-48208.json index b4edc86925b..6995b3cb8ef 100644 --- a/CVE-2024/CVE-2024-482xx/CVE-2024-48208.json +++ b/CVE-2024/CVE-2024-482xx/CVE-2024-48208.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Las versiones anteriores a la 1.0.52 de pure-ftpd son vulnerables a desbordamientos de b\u00fafer. Hay una lectura fuera de l\u00edmites en la funci\u00f3n domlsd() del archivo ls.c." + "value": "pure-ftpd before 1.0.52 es vulnerable a desbordamiento de b\u00fafer. Hay una lectura fuera de los l\u00edmites en la funci\u00f3n domlsd() del archivo ls.c." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-487xx/CVE-2024-48729.json b/CVE-2024/CVE-2024-487xx/CVE-2024-48729.json index 768f0cbe16e..43552dfa22e 100644 --- a/CVE-2024/CVE-2024-487xx/CVE-2024-48729.json +++ b/CVE-2024/CVE-2024-487xx/CVE-2024-48729.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An issue in ETSI Open-Source MANO (OSM) v.14.x, v.15.x allows a remote attacker to escalate privileges via the /osm/admin/v1/users component" + }, + { + "lang": "es", + "value": "Un problema en ETSI Open-Source MANO (OSM) v.14.x, v.15.x permite que un atacante remoto escale privilegios a trav\u00e9s del componente /osm/admin/v1/users" } ], "metrics": { diff --git a/CVE-2024/CVE-2024-487xx/CVE-2024-48730.json b/CVE-2024/CVE-2024-487xx/CVE-2024-48730.json index 80ae1c56011..f951644a67f 100644 --- a/CVE-2024/CVE-2024-487xx/CVE-2024-48730.json +++ b/CVE-2024/CVE-2024-487xx/CVE-2024-48730.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An issue in ETSI Open-Source MANO (OSM) v.14.x, v.15.x allows a remote attacker to escalate privileges via not imposing any restrictions on the authentication attempts performed by an admin user" + }, + { + "lang": "es", + "value": "Un problema en ETSI Open-Source MANO (OSM) v.14.x, v.15.x permite que un atacante remoto escale privilegios al no imponer ninguna restricci\u00f3n en los intentos de autenticaci\u00f3n realizados por un usuario administrador." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-493xx/CVE-2024-49342.json b/CVE-2024/CVE-2024-493xx/CVE-2024-49342.json index c587b0b19aa..6c47d885376 100644 --- a/CVE-2024/CVE-2024-493xx/CVE-2024-49342.json +++ b/CVE-2024/CVE-2024-493xx/CVE-2024-49342.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@us.ibm.com", "published": "2025-07-28T16:15:24.220", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-493xx/CVE-2024-49343.json b/CVE-2024/CVE-2024-493xx/CVE-2024-49343.json index 6c131850937..b254ad26015 100644 --- a/CVE-2024/CVE-2024-493xx/CVE-2024-49343.json +++ b/CVE-2024/CVE-2024-493xx/CVE-2024-49343.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@us.ibm.com", "published": "2025-07-28T16:15:24.433", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-506xx/CVE-2024-50633.json b/CVE-2024/CVE-2024-506xx/CVE-2024-50633.json index 4866e40cccf..1d6121a206f 100644 --- a/CVE-2024/CVE-2024-506xx/CVE-2024-50633.json +++ b/CVE-2024/CVE-2024-506xx/CVE-2024-50633.json @@ -19,7 +19,7 @@ }, { "lang": "es", - "value": " Una vulnerabilidad de autorizaci\u00f3n a nivel de objeto roto (BOLA) en Indico v3.2.9 permite a los atacantes acceder a informaci\u00f3n confidencial mediante el env\u00edo de una solicitud POST manipulada al componente /api/principals." + "value": "Una vulnerabilidad de autorizaci\u00f3n a nivel de objeto roto (BOLA) en Indico v3.2.9 permite a los atacantes acceder a informaci\u00f3n confidencial mediante el env\u00edo de una solicitud POST manipulada al componente /api/principals." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-511xx/CVE-2024-51139.json b/CVE-2024/CVE-2024-511xx/CVE-2024-51139.json index e50c815642e..dd540ec9f5b 100644 --- a/CVE-2024/CVE-2024-511xx/CVE-2024-51139.json +++ b/CVE-2024/CVE-2024-511xx/CVE-2024-51139.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Vulnerabilidad de desbordamiento de b\u00fafer en Vigor2620/LTE200 3.9.8.9 y anteriores y Vigor2860/2925 3.9.8 y anteriores y Vigor2862/2926 3.9.9.5 y anteriores y Vigor2133/2762/2832 3.9.9 y anteriores y Vigor165/166 4.2.7 y anteriores y Vigor2135/2765/2766 4.4.5.1 y anteriores y Vigor2865/2866/2927 4.4.5.3 y anteriores y Vigor2962/3910 4.3.2.8/4.4.3.1 y anteriores y Vigor3912 4.3.6.1 y anteriores permite a un atacante remoto ejecutar c\u00f3digo arbitrario a trav\u00e9s de la gesti\u00f3n del analizador CGI de \"Content-Length\". encabezado de solicitudes HTTP POST." + "value": "Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and Vigor165/166 4.2.7 and earlier and Vigor2135/2765/2766 4.4.5.1 and earlier and Vigor2865/2866/2927 4.4.5.3 and earlier and Vigor2962/3910 4.3.2.8/4.4.3.1 and earlier and Vigor3912 4.3.6.1 and earlier allows a remote attacker to execute arbitrary code via the CGI parser's handling of the \"Content-Length\" header of HTTP POST requests." } ], "metrics": { diff --git a/CVE-2024/CVE-2024-525xx/CVE-2024-52597.json b/CVE-2024/CVE-2024-525xx/CVE-2024-52597.json index c6499decf35..37d042ba0d6 100644 --- a/CVE-2024/CVE-2024-525xx/CVE-2024-52597.json +++ b/CVE-2024/CVE-2024-525xx/CVE-2024-52597.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2024-11-20T14:15:17.967", "lastModified": "2024-11-21T13:57:24.187", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-525xx/CVE-2024-52598.json b/CVE-2024/CVE-2024-525xx/CVE-2024-52598.json index 70f4a8a1d0c..6541d813f5f 100644 --- a/CVE-2024/CVE-2024-525xx/CVE-2024-52598.json +++ b/CVE-2024/CVE-2024-525xx/CVE-2024-52598.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2024-11-20T15:15:11.667", "lastModified": "2024-11-21T13:57:24.187", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-550xx/CVE-2024-55040.json b/CVE-2024/CVE-2024-550xx/CVE-2024-55040.json index c486a5a985f..d70597d6e92 100644 --- a/CVE-2024/CVE-2024-550xx/CVE-2024-55040.json +++ b/CVE-2024/CVE-2024-550xx/CVE-2024-55040.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T16:15:28.717", "lastModified": "2025-07-22T16:15:26.400", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-582xx/CVE-2024-58261.json b/CVE-2024/CVE-2024-582xx/CVE-2024-58261.json index edb83663cee..82121578d47 100644 --- a/CVE-2024/CVE-2024-582xx/CVE-2024-58261.json +++ b/CVE-2024/CVE-2024-582xx/CVE-2024-58261.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-27T20:15:24.810", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-582xx/CVE-2024-58262.json b/CVE-2024/CVE-2024-582xx/CVE-2024-58262.json index 9e2cbb07ec4..f1f31993814 100644 --- a/CVE-2024/CVE-2024-582xx/CVE-2024-58262.json +++ b/CVE-2024/CVE-2024-582xx/CVE-2024-58262.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-27T20:15:25.057", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-582xx/CVE-2024-58263.json b/CVE-2024/CVE-2024-582xx/CVE-2024-58263.json index d644c1da537..8e1f805d169 100644 --- a/CVE-2024/CVE-2024-582xx/CVE-2024-58263.json +++ b/CVE-2024/CVE-2024-582xx/CVE-2024-58263.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-27T20:15:25.230", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-582xx/CVE-2024-58264.json b/CVE-2024/CVE-2024-582xx/CVE-2024-58264.json index cdde404feed..83db01c324d 100644 --- a/CVE-2024/CVE-2024-582xx/CVE-2024-58264.json +++ b/CVE-2024/CVE-2024-582xx/CVE-2024-58264.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-27T21:15:26.453", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-582xx/CVE-2024-58265.json b/CVE-2024/CVE-2024-582xx/CVE-2024-58265.json index cb1dc423ba5..c79224a728f 100644 --- a/CVE-2024/CVE-2024-582xx/CVE-2024-58265.json +++ b/CVE-2024/CVE-2024-582xx/CVE-2024-58265.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-27T22:15:24.647", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-582xx/CVE-2024-58266.json b/CVE-2024/CVE-2024-582xx/CVE-2024-58266.json index 66ce6636743..a1e2e16fca4 100644 --- a/CVE-2024/CVE-2024-582xx/CVE-2024-58266.json +++ b/CVE-2024/CVE-2024-582xx/CVE-2024-58266.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-27T22:15:25.707", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2024/CVE-2024-60xx/CVE-2024-6047.json b/CVE-2024/CVE-2024-60xx/CVE-2024-6047.json index 7c7819081d5..ed4d6e8a495 100644 --- a/CVE-2024/CVE-2024-60xx/CVE-2024-6047.json +++ b/CVE-2024/CVE-2024-60xx/CVE-2024-6047.json @@ -26,7 +26,7 @@ "cvssMetricV31": [ { "source": "twcert@cert.org.tw", - "type": "Primary", + "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", @@ -53,7 +53,7 @@ "weaknesses": [ { "source": "twcert@cert.org.tw", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2024/CVE-2024-67xx/CVE-2024-6788.json b/CVE-2024/CVE-2024-67xx/CVE-2024-6788.json index df5aff4bc2d..f1ea0a5aea8 100644 --- a/CVE-2024/CVE-2024-67xx/CVE-2024-6788.json +++ b/CVE-2024/CVE-2024-67xx/CVE-2024-6788.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Un atacante remoto no autenticado puede utilizar la funci\u00f3n de actualizaci\u00f3n de firmware en la interfaz LAN del dispositivo para restablecer la contrase\u00f1a de la \"aplicaci\u00f3n de usuario\" predefinida y con pocos privilegios a la contrase\u00f1a predeterminada." + "value": "Un atacante remoto no autenticado puede utilizar la funci\u00f3n de actualizaci\u00f3n de firmware en la interfaz LAN del dispositivo para restablecer la contrase\u00f1a de la \"aplicaci\u00f3n de usuario\" predefinida y con pocos privilegios a la contrase\u00f1a predeterminada.\n" } ], "metrics": { diff --git a/CVE-2025/CVE-2025-02xx/CVE-2025-0249.json b/CVE-2025/CVE-2025-02xx/CVE-2025-0249.json index c16b7f6e750..afb286aa7b3 100644 --- a/CVE-2025/CVE-2025-02xx/CVE-2025-0249.json +++ b/CVE-2025/CVE-2025-02xx/CVE-2025-0249.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "HCL IEM is affected by an improper invalidation of access or JWT token vulnerability.\u00a0 A token was not invalidated which may allow attackers to access sensitive data without authorization." + }, + { + "lang": "es", + "value": "HCL IEM se ve afectado por una vulnerabilidad de invalidaci\u00f3n de acceso indebida o de token JWT. Un token no fue invalidado, lo que podr\u00eda permitir a atacantes acceder a datos confidenciales sin autorizaci\u00f3n." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-02xx/CVE-2025-0250.json b/CVE-2025/CVE-2025-02xx/CVE-2025-0250.json index 00f5e37ffa6..3663a878369 100644 --- a/CVE-2025/CVE-2025-02xx/CVE-2025-0250.json +++ b/CVE-2025/CVE-2025-02xx/CVE-2025-0250.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "HCL IEM is affected by an authorization token sent in cookie vulnerability.\u00a0 A token used for authentication and authorization is being handled in a manner that may increase its exposure to security risks." + }, + { + "lang": "es", + "value": "HCL IEM se ve afectado por un token de autorizaci\u00f3n enviado en una vulnerabilidad de cookies. Un token utilizado para autenticaci\u00f3n y autorizaci\u00f3n se gestiona de una manera que puede aumentar su exposici\u00f3n a riesgos de seguridad." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-02xx/CVE-2025-0251.json b/CVE-2025/CVE-2025-02xx/CVE-2025-0251.json index bf85a80c156..ca3e4c6483f 100644 --- a/CVE-2025/CVE-2025-02xx/CVE-2025-0251.json +++ b/CVE-2025/CVE-2025-02xx/CVE-2025-0251.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "HCL IEM is affected by a concurrent login vulnerability.\u00a0 The application allows multiple concurrent sessions using the same user credentials, which may introduce security risks." + }, + { + "lang": "es", + "value": "HCL IEM se ve afectado por una vulnerabilidad de inicio de sesi\u00f3n simult\u00e1neo. La aplicaci\u00f3n permite m\u00faltiples sesiones simult\u00e1neas con las mismas credenciales de usuario, lo que puede suponer riesgos de seguridad." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-02xx/CVE-2025-0252.json b/CVE-2025/CVE-2025-02xx/CVE-2025-0252.json index 1c72f42196c..f33e25a617b 100644 --- a/CVE-2025/CVE-2025-02xx/CVE-2025-0252.json +++ b/CVE-2025/CVE-2025-02xx/CVE-2025-0252.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "HCL IEM is affected by a password in cleartext vulnerability.\u00a0 Sensitive information is transmitted without adequate protection, potentially exposing it to unauthorized access during transit." + }, + { + "lang": "es", + "value": "HCL IEM se ve afectado por una vulnerabilidad de contrase\u00f1a en texto plano. La informaci\u00f3n confidencial se transmite sin la protecci\u00f3n adecuada, lo que podr\u00eda exponerla a accesos no autorizados durante su transmisi\u00f3n." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-02xx/CVE-2025-0253.json b/CVE-2025/CVE-2025-02xx/CVE-2025-0253.json index e2fc0648bce..a9d22b34d18 100644 --- a/CVE-2025/CVE-2025-02xx/CVE-2025-0253.json +++ b/CVE-2025/CVE-2025-02xx/CVE-2025-0253.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could increase exposure to potential vulnerabilities." + }, + { + "lang": "es", + "value": "HCL IEM se ve afectado por una vulnerabilidad de atributo de cookie no configurado debido a la inconsistencia de ciertas configuraciones relacionadas con la seguridad, lo que podr\u00eda aumentar la exposici\u00f3n a posibles vulnerabilidades." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-06xx/CVE-2025-0626.json b/CVE-2025/CVE-2025-06xx/CVE-2025-0626.json index 1aca40cdbed..74c5e5bcd81 100644 --- a/CVE-2025/CVE-2025-06xx/CVE-2025-0626.json +++ b/CVE-2025/CVE-2025-06xx/CVE-2025-0626.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "El binario \"monitor\" del firmware del producto afectado intenta conectarse a una direcci\u00f3n IP enrutable predefinida, ignorando la configuraci\u00f3n de red del dispositivo. Esta funci\u00f3n tambi\u00e9n habilita la interfaz de red del dispositivo si est\u00e1 deshabilitada. Se activa al intentar actualizar el dispositivo desde el men\u00fa de usuario. Esto podr\u00eda actuar como una puerta trasera al dispositivo y permitir que un atacante malicioso cargue y sobrescriba archivos en \u00e9l." + "value": "The \"monitor\" binary in the firmware of the affected product attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function also enables the network interface of the device if it is disabled. The function is triggered by attempting to update the device from the user menu. This could serve as a backdoor to the device, and could lead to a malicious actor being able to upload and overwrite files on the device." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-07xx/CVE-2025-0765.json b/CVE-2025/CVE-2025-07xx/CVE-2025-0765.json index 8c98b454861..0dd719eed36 100644 --- a/CVE-2025/CVE-2025-07xx/CVE-2025-0765.json +++ b/CVE-2025/CVE-2025-07xx/CVE-2025-0765.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an unauthorized user to access custom service desk email addresses." + }, + { + "lang": "es", + "value": "Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 17.9 hasta la 18.0.5, la 18.1 hasta la 18.1.3 y la 18.2 hasta la 18.2.1, que podr\u00eda haber permitido que un usuario no autorizado accediera a direcciones de correo electr\u00f3nico de la mesa de ayuda personalizadas." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-08xx/CVE-2025-0825.json b/CVE-2025/CVE-2025-08xx/CVE-2025-0825.json index c11ed017837..c8eb3e9cf68 100644 --- a/CVE-2025/CVE-2025-08xx/CVE-2025-0825.json +++ b/CVE-2025/CVE-2025-08xx/CVE-2025-0825.json @@ -3,7 +3,7 @@ "sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "published": "2025-02-04T15:15:19.420", "lastModified": "2025-05-23T13:15:25.687", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-17xx/CVE-2025-1753.json b/CVE-2025/CVE-2025-17xx/CVE-2025-1753.json index 3d11ab7140e..5039425761b 100644 --- a/CVE-2025/CVE-2025-17xx/CVE-2025-1753.json +++ b/CVE-2025/CVE-2025-17xx/CVE-2025-1753.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@huntr.dev", "published": "2025-05-28T10:15:21.333", "lastModified": "2025-05-28T15:01:30.720", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-201xx/CVE-2025-20120.json b/CVE-2025/CVE-2025-201xx/CVE-2025-20120.json index 0a6b7866eb1..c65304361da 100644 --- a/CVE-2025/CVE-2025-201xx/CVE-2025-20120.json +++ b/CVE-2025/CVE-2025-201xx/CVE-2025-20120.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-04-02T17:15:42.570", "lastModified": "2025-04-07T14:18:49.830", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-201xx/CVE-2025-20137.json b/CVE-2025/CVE-2025-201xx/CVE-2025-20137.json index 00a4c2f74da..99c5900b07d 100644 --- a/CVE-2025/CVE-2025-201xx/CVE-2025-20137.json +++ b/CVE-2025/CVE-2025-201xx/CVE-2025-20137.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-05-07T18:15:36.473", "lastModified": "2025-05-08T14:39:09.683", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-201xx/CVE-2025-20144.json b/CVE-2025/CVE-2025-201xx/CVE-2025-20144.json index 4395c0d733a..0d4288c0ecb 100644 --- a/CVE-2025/CVE-2025-201xx/CVE-2025-20144.json +++ b/CVE-2025/CVE-2025-201xx/CVE-2025-20144.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-03-12T16:15:21.890", "lastModified": "2025-08-01T18:45:58.497", - "vulnStatus": "Analyzed", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-201xx/CVE-2025-20145.json b/CVE-2025/CVE-2025-201xx/CVE-2025-20145.json index 3c29a5b5d45..d3988aa8709 100644 --- a/CVE-2025/CVE-2025-201xx/CVE-2025-20145.json +++ b/CVE-2025/CVE-2025-201xx/CVE-2025-20145.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-03-12T16:15:22.040", "lastModified": "2025-08-01T18:48:37.243", - "vulnStatus": "Analyzed", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-201xx/CVE-2025-20151.json b/CVE-2025/CVE-2025-201xx/CVE-2025-20151.json index 96c97d2cf46..bc7b6e663b3 100644 --- a/CVE-2025/CVE-2025-201xx/CVE-2025-20151.json +++ b/CVE-2025/CVE-2025-201xx/CVE-2025-20151.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-05-07T18:15:37.007", "lastModified": "2025-05-08T14:39:09.683", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-201xx/CVE-2025-20157.json b/CVE-2025/CVE-2025-201xx/CVE-2025-20157.json index 3c8bc40d770..0a4b53a0c27 100644 --- a/CVE-2025/CVE-2025-201xx/CVE-2025-20157.json +++ b/CVE-2025/CVE-2025-201xx/CVE-2025-20157.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-05-07T18:15:37.480", "lastModified": "2025-05-08T14:39:09.683", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-201xx/CVE-2025-20181.json b/CVE-2025/CVE-2025-201xx/CVE-2025-20181.json index 7af4e9f8fa8..7c69ec95894 100644 --- a/CVE-2025/CVE-2025-201xx/CVE-2025-20181.json +++ b/CVE-2025/CVE-2025-201xx/CVE-2025-20181.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-05-07T18:15:37.973", "lastModified": "2025-05-08T14:39:09.683", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-201xx/CVE-2025-20187.json b/CVE-2025/CVE-2025-201xx/CVE-2025-20187.json index 504a6c840f2..095bd445c25 100644 --- a/CVE-2025/CVE-2025-201xx/CVE-2025-20187.json +++ b/CVE-2025/CVE-2025-201xx/CVE-2025-20187.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-05-07T18:15:38.463", "lastModified": "2025-05-08T14:39:09.683", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-201xx/CVE-2025-20189.json b/CVE-2025/CVE-2025-201xx/CVE-2025-20189.json index d0894af8ef3..d71c87cd518 100644 --- a/CVE-2025/CVE-2025-201xx/CVE-2025-20189.json +++ b/CVE-2025/CVE-2025-201xx/CVE-2025-20189.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-05-07T18:15:38.770", "lastModified": "2025-05-08T14:39:09.683", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-201xx/CVE-2025-20192.json b/CVE-2025/CVE-2025-201xx/CVE-2025-20192.json index 2188b11775a..92020957404 100644 --- a/CVE-2025/CVE-2025-201xx/CVE-2025-20192.json +++ b/CVE-2025/CVE-2025-201xx/CVE-2025-20192.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-05-07T18:15:39.280", "lastModified": "2025-05-08T14:39:09.683", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-202xx/CVE-2025-20210.json b/CVE-2025/CVE-2025-202xx/CVE-2025-20210.json index 3cddedbe3db..7db0736eff6 100644 --- a/CVE-2025/CVE-2025-202xx/CVE-2025-20210.json +++ b/CVE-2025/CVE-2025-202xx/CVE-2025-20210.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-05-07T18:15:41.240", "lastModified": "2025-05-08T14:39:09.683", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-202xx/CVE-2025-20213.json b/CVE-2025/CVE-2025-202xx/CVE-2025-20213.json index 6c62309e344..f9f67e0d165 100644 --- a/CVE-2025/CVE-2025-202xx/CVE-2025-20213.json +++ b/CVE-2025/CVE-2025-202xx/CVE-2025-20213.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-05-07T18:15:41.410", "lastModified": "2025-05-08T14:39:09.683", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-202xx/CVE-2025-20214.json b/CVE-2025/CVE-2025-202xx/CVE-2025-20214.json index def7fd5039c..27439268f2e 100644 --- a/CVE-2025/CVE-2025-202xx/CVE-2025-20214.json +++ b/CVE-2025/CVE-2025-202xx/CVE-2025-20214.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-05-07T18:15:41.573", "lastModified": "2025-05-08T14:39:09.683", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-202xx/CVE-2025-20298.json b/CVE-2025/CVE-2025-202xx/CVE-2025-20298.json index 00dc03a0d07..5fa8391ea09 100644 --- a/CVE-2025/CVE-2025-202xx/CVE-2025-20298.json +++ b/CVE-2025/CVE-2025-202xx/CVE-2025-20298.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@cisco.com", "published": "2025-06-02T18:15:23.560", "lastModified": "2025-06-04T14:54:53.980", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-22xx/CVE-2025-2297.json b/CVE-2025/CVE-2025-22xx/CVE-2025-2297.json index e999b84a4e3..4b77b4ba73e 100644 --- a/CVE-2025/CVE-2025-22xx/CVE-2025-2297.json +++ b/CVE-2025/CVE-2025-22xx/CVE-2025-2297.json @@ -3,7 +3,7 @@ "sourceIdentifier": "13061848-ea10-403d-bd75-c83a022c2891", "published": "2025-07-28T16:15:24.660", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-232xx/CVE-2025-23289.json b/CVE-2025/CVE-2025-232xx/CVE-2025-23289.json index f1907bf2397..ea1fb54753e 100644 --- a/CVE-2025/CVE-2025-232xx/CVE-2025-23289.json +++ b/CVE-2025/CVE-2025-232xx/CVE-2025-23289.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause sensitive information to be written to the log files through proxy servers. A successful exploit of this vulnerability might lead to information disclosure." + }, + { + "lang": "es", + "value": "NVIDIA Omniverse Launcher para Windows y Linux contiene una vulnerabilidad en los registros del lanzador, que podr\u00eda provocar que un usuario escriba informaci\u00f3n confidencial en los archivos de registro a trav\u00e9s de servidores proxy. Aprovechar esta vulnerabilidad podr\u00eda provocar la divulgaci\u00f3n de informaci\u00f3n." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-248xx/CVE-2025-24853.json b/CVE-2025/CVE-2025-248xx/CVE-2025-24853.json index f9d8ef45902..f5e4012e805 100644 --- a/CVE-2025/CVE-2025-248xx/CVE-2025-24853.json +++ b/CVE-2025/CVE-2025-248xx/CVE-2025-24853.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@apache.org", "published": "2025-07-31T09:15:26.160", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-248xx/CVE-2025-24854.json b/CVE-2025/CVE-2025-248xx/CVE-2025-24854.json index b60ba9aad40..f706c426085 100644 --- a/CVE-2025/CVE-2025-248xx/CVE-2025-24854.json +++ b/CVE-2025/CVE-2025-248xx/CVE-2025-24854.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@apache.org", "published": "2025-07-31T09:15:27.650", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-249xx/CVE-2025-24936.json b/CVE-2025/CVE-2025-249xx/CVE-2025-24936.json index 31ba7f7d50e..3bdbaf66a69 100644 --- a/CVE-2025/CVE-2025-249xx/CVE-2025-24936.json +++ b/CVE-2025/CVE-2025-249xx/CVE-2025-24936.json @@ -3,7 +3,7 @@ "sourceIdentifier": "b48c3b8f-639e-4c16-8725-497bc411dad0", "published": "2025-07-21T07:15:23.890", "lastModified": "2025-07-23T19:15:32.570", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-249xx/CVE-2025-24937.json b/CVE-2025/CVE-2025-249xx/CVE-2025-24937.json index a223c1f3692..79882cb7d88 100644 --- a/CVE-2025/CVE-2025-249xx/CVE-2025-24937.json +++ b/CVE-2025/CVE-2025-249xx/CVE-2025-24937.json @@ -3,7 +3,7 @@ "sourceIdentifier": "b48c3b8f-639e-4c16-8725-497bc411dad0", "published": "2025-07-21T07:15:24.007", "lastModified": "2025-07-23T19:15:32.770", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-249xx/CVE-2025-24938.json b/CVE-2025/CVE-2025-249xx/CVE-2025-24938.json index c7405ffdd5e..4bb262771ef 100644 --- a/CVE-2025/CVE-2025-249xx/CVE-2025-24938.json +++ b/CVE-2025/CVE-2025-249xx/CVE-2025-24938.json @@ -3,7 +3,7 @@ "sourceIdentifier": "b48c3b8f-639e-4c16-8725-497bc411dad0", "published": "2025-07-21T07:15:24.130", "lastModified": "2025-07-23T19:15:32.963", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-249xx/CVE-2025-24969.json b/CVE-2025/CVE-2025-249xx/CVE-2025-24969.json index 34c0741251b..b94fdfde821 100644 --- a/CVE-2025/CVE-2025-249xx/CVE-2025-24969.json +++ b/CVE-2025/CVE-2025-249xx/CVE-2025-24969.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-05-14T16:15:27.300", "lastModified": "2025-05-16T14:43:56.797", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-25xx/CVE-2025-2533.json b/CVE-2025/CVE-2025-25xx/CVE-2025-2533.json index 881409d41f5..20bddc9df37 100644 --- a/CVE-2025/CVE-2025-25xx/CVE-2025-2533.json +++ b/CVE-2025/CVE-2025-25xx/CVE-2025-2533.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@us.ibm.com", "published": "2025-07-29T18:15:27.567", "lastModified": "2025-07-31T18:42:56.503", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-260xx/CVE-2025-26062.json b/CVE-2025/CVE-2025-260xx/CVE-2025-26062.json index eca1bd09996..4fa33d38947 100644 --- a/CVE-2025/CVE-2025-260xx/CVE-2025-26062.json +++ b/CVE-2025/CVE-2025-260xx/CVE-2025-26062.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file and obtain potentially sensitive information from the current settings." + }, + { + "lang": "es", + "value": "Un problema de control de acceso en Intelbras RX1500 v2.2.9 y RX3000 v1.0.11 permite a atacantes no autenticados acceder al archivo de configuraci\u00f3n del enrutador y obtener informaci\u00f3n potencialmente confidencial de la configuraci\u00f3n actual." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-260xx/CVE-2025-26063.json b/CVE-2025/CVE-2025-260xx/CVE-2025-26063.json index 9b996fccc08..daa52e1397e 100644 --- a/CVE-2025/CVE-2025-260xx/CVE-2025-26063.json +++ b/CVE-2025/CVE-2025-260xx/CVE-2025-26063.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSID name when creating a network." + }, + { + "lang": "es", + "value": "Un problema en Intelbras RX1500 v2.2.9 y RX3000 v1.0.11 permite a atacantes no autenticados ejecutar c\u00f3digo arbitrario mediante la inyecci\u00f3n de un payload manipulado en el nombre ESSID al crear una red." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-260xx/CVE-2025-26064.json b/CVE-2025/CVE-2025-260xx/CVE-2025-26064.json index a71119d7316..363bcedaa67 100644 --- a/CVE-2025/CVE-2025-260xx/CVE-2025-26064.json +++ b/CVE-2025/CVE-2025-260xx/CVE-2025-26064.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a connnected device." + }, + { + "lang": "es", + "value": "Una vulnerabilidad de Cross-site Scripting (XSS) en Intelbras RX1500 v2.2.9 y RX3000 v1.0.11 permite a los atacantes ejecutar scripts web o HTML arbitrarios mediante la inyecci\u00f3n de un payload manipulado en el nombre de un dispositivo conectado." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-263xx/CVE-2025-26397.json b/CVE-2025/CVE-2025-263xx/CVE-2025-26397.json index 55a7d9a16d3..84bddbf3b45 100644 --- a/CVE-2025/CVE-2025-263xx/CVE-2025-26397.json +++ b/CVE-2025/CVE-2025-263xx/CVE-2025-26397.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privileges can escalate privileges to run malicious files copied to a permission-protected folder. This vulnerability requires authentication from a low-level account and local access to the host server." + }, + { + "lang": "es", + "value": "SolarWinds Observability Self-Hosted es susceptible a la vulnerabilidad de escalada de privilegios locales por deserializaci\u00f3n de datos no confiables. Un atacante con privilegios bajos puede escalarlos para ejecutar archivos maliciosos copiados a una carpeta protegida con permisos. Esta vulnerabilidad requiere autenticaci\u00f3n desde una cuenta de bajo nivel y acceso local al servidor host." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-264xx/CVE-2025-26400.json b/CVE-2025/CVE-2025-264xx/CVE-2025-26400.json index eebe3e9acb9..0045809fa6f 100644 --- a/CVE-2025/CVE-2025-264xx/CVE-2025-26400.json +++ b/CVE-2025/CVE-2025-264xx/CVE-2025-26400.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files." + }, + { + "lang": "es", + "value": "Se inform\u00f3 que SolarWinds Web Help Desk se vio afectado por una vulnerabilidad de inyecci\u00f3n de entidades externas XML (XXE) que podr\u00eda provocar la divulgaci\u00f3n de informaci\u00f3n. Se requiere un acceso v\u00e1lido con privilegios bajos, a menos que el atacante tuviera acceso al servidor local para modificar los archivos de configuraci\u00f3n." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-265xx/CVE-2025-26597.json b/CVE-2025/CVE-2025-265xx/CVE-2025-26597.json index 667d3a59ed0..b4bdb17cec8 100644 --- a/CVE-2025/CVE-2025-265xx/CVE-2025-26597.json +++ b/CVE-2025/CVE-2025-265xx/CVE-2025-26597.json @@ -62,7 +62,7 @@ "weaknesses": [ { "source": "secalert@redhat.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2025/CVE-2025-266xx/CVE-2025-26621.json b/CVE-2025/CVE-2025-266xx/CVE-2025-26621.json index 80e6d7304f3..67bc08ed386 100644 --- a/CVE-2025/CVE-2025-266xx/CVE-2025-26621.json +++ b/CVE-2025/CVE-2025-266xx/CVE-2025-26621.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-05-19T16:15:28.560", "lastModified": "2025-05-21T20:25:16.407", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-26xx/CVE-2025-2633.json b/CVE-2025/CVE-2025-26xx/CVE-2025-2633.json index 9b51885f3cd..dc1eca1eae3 100644 --- a/CVE-2025/CVE-2025-26xx/CVE-2025-2633.json +++ b/CVE-2025/CVE-2025-26xx/CVE-2025-2633.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in lvre!UDecStrToNum that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions." + }, + { + "lang": "es", + "value": "Vulnerabilidad de lectura fuera de los l\u00edmites debido a una comprobaci\u00f3n incorrecta de los l\u00edmites en NI LabVIEW en lvre!UDecStrToNum, que puede provocar la divulgaci\u00f3n de informaci\u00f3n o la ejecuci\u00f3n de c\u00f3digo arbitrario. Para explotarla con \u00e9xito, el atacante debe obligar al usuario a abrir un VI especialmente manipulado. Esta vulnerabilidad afecta a NI LabVIEW 2025 Q1 y versiones anteriores." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-26xx/CVE-2025-2634.json b/CVE-2025/CVE-2025-26xx/CVE-2025-2634.json index ca855da08f7..63a9bcb65be 100644 --- a/CVE-2025/CVE-2025-26xx/CVE-2025-2634.json +++ b/CVE-2025/CVE-2025-26xx/CVE-2025-2634.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in fontmgr may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions." + }, + { + "lang": "es", + "value": "Una vulnerabilidad de lectura fuera de los l\u00edmites, debida a una comprobaci\u00f3n incorrecta de los l\u00edmites en NI LabVIEW en fontmgr, puede provocar la divulgaci\u00f3n de informaci\u00f3n o la ejecuci\u00f3n de c\u00f3digo arbitrario. Para explotarla con \u00e9xito, el atacante debe obligar al usuario a abrir un VI especialmente manipulado. Esta vulnerabilidad afecta a NI LabVIEW 2025 Q1 y versiones anteriores." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-279xx/CVE-2025-27930.json b/CVE-2025/CVE-2025-279xx/CVE-2025-27930.json index 4184c37b72b..804f6c1a29a 100644 --- a/CVE-2025/CVE-2025-279xx/CVE-2025-27930.json +++ b/CVE-2025/CVE-2025-279xx/CVE-2025-27930.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Zohocorp ManageEngine Applications Manager versions\u00a0176600 and prior are vulnerable to stored cross-site scripting in the\u00a0File/Directory monitor." + }, + { + "lang": "es", + "value": "Las versiones 176600 y anteriores de Zohocorp ManageEngine Applications Manager son vulnerables a cross-site scripting almacenado en el monitor de archivos y directorios." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-295xx/CVE-2025-29556.json b/CVE-2025/CVE-2025-295xx/CVE-2025-29556.json index 6c05aecd924..188258e5977 100644 --- a/CVE-2025/CVE-2025-295xx/CVE-2025-29556.json +++ b/CVE-2025/CVE-2025-295xx/CVE-2025-29556.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restrictions preventing users with the Admin role from creating or modifying users with the Security Officer role without approval. However, a flaw in the account creation process allows an attacker to bypass these restrictions via API request manipulation. An attacker with an Admin access can intercept and modify the API request during user creation, altering the parameters to assign the new account to the ExaGrid Security Officers group without the required approval." + }, + { + "lang": "es", + "value": "ExaGrid EX10 6.3 - 7.0.1.P08 es vulnerable a un control de acceso incorrecto. Desde la versi\u00f3n 6.3, ExaGrid aplica restricciones que impiden a los usuarios con el rol de administrador crear o modificar usuarios con el rol de oficial de seguridad sin autorizaci\u00f3n. Sin embargo, una falla en el proceso de creaci\u00f3n de cuentas permite a un atacante eludir estas restricciones mediante la manipulaci\u00f3n de solicitudes de API. Un atacante con acceso de administrador puede interceptar y modificar la solicitud de API durante la creaci\u00f3n del usuario, alterando los par\u00e1metros para asignar la nueva cuenta al grupo de oficiales de seguridad de ExaGrid sin la autorizaci\u00f3n necesaria." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-295xx/CVE-2025-29557.json b/CVE-2025/CVE-2025-295xx/CVE-2025-29557.json index 74a4e011ba5..502921a1b2b 100644 --- a/CVE-2025/CVE-2025-295xx/CVE-2025-29557.json +++ b/CVE-2025/CVE-2025-295xx/CVE-2025-29557.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-level privileges can issue an HTTP request to retrieve SMTP credentials, including plaintext passwords." + }, + { + "lang": "es", + "value": "ExaGrid EX10 6.3 - 7.0.1.P08 es vulnerable a un control de acceso incorrecto en el endpoint de la API MailConfiguration, donde los usuarios con privilegios de nivel de operador pueden emitir una solicitud HTTP para recuperar credenciales SMTP, incluidas contrase\u00f1as de texto sin formato." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-300xx/CVE-2025-30086.json b/CVE-2025/CVE-2025-300xx/CVE-2025-30086.json index e5d2b647713..b76a4a642bc 100644 --- a/CVE-2025/CVE-2025-300xx/CVE-2025-30086.json +++ b/CVE-2025/CVE-2025-300xx/CVE-2025-30086.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter password=~ could be abused to leak out a user's password hash character by character. An attacker with administrator access could exploit this to leak highly sensitive information stored in the Harbor database. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack." + }, + { + "lang": "es", + "value": "CNCF Harbor 2.13.x (versi\u00f3n anterior a la 2.13.1) y 2.12.x (versi\u00f3n anterior a la 2.12.4) permite la divulgaci\u00f3n de informaci\u00f3n por parte de administradores que pueden explotar una fuga de ORM presente en el endpoint /api/v2.0/users para filtrar los valores hash y sal de las contrase\u00f1as de los usuarios. El par\u00e1metro q URL permite filtrar usuarios por cualquier columna, y filter password=~ podr\u00eda utilizarse de forma abusiva para filtrar el hash de la contrase\u00f1a de un usuario car\u00e1cter por car\u00e1cter. Un atacante con acceso de administrador podr\u00eda explotar esto para filtrar informaci\u00f3n altamente sensible almacenada en la base de datos de Harbor. Todos los endpoints que admiten el par\u00e1metro q URL son vulnerables a este ataque de fuga de ORM." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-301xx/CVE-2025-30183.json b/CVE-2025/CVE-2025-301xx/CVE-2025-30183.json index 1901dc6d0f9..1e1fe5fdd9c 100644 --- a/CVE-2025/CVE-2025-301xx/CVE-2025-30183.json +++ b/CVE-2025/CVE-2025-301xx/CVE-2025-30183.json @@ -3,7 +3,7 @@ "sourceIdentifier": "ics-cert@hq.dhs.gov", "published": "2025-06-09T23:15:21.947", "lastModified": "2025-06-12T16:06:39.330", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-301xx/CVE-2025-30184.json b/CVE-2025/CVE-2025-301xx/CVE-2025-30184.json index 06c4cca9a75..44d6254a36c 100644 --- a/CVE-2025/CVE-2025-301xx/CVE-2025-30184.json +++ b/CVE-2025/CVE-2025-301xx/CVE-2025-30184.json @@ -3,7 +3,7 @@ "sourceIdentifier": "ics-cert@hq.dhs.gov", "published": "2025-06-09T22:15:21.440", "lastModified": "2025-06-12T16:06:47.857", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-305xx/CVE-2025-30507.json b/CVE-2025/CVE-2025-305xx/CVE-2025-30507.json index b2459eaafd9..a5bdca8a1de 100644 --- a/CVE-2025/CVE-2025-305xx/CVE-2025-30507.json +++ b/CVE-2025/CVE-2025-305xx/CVE-2025-30507.json @@ -3,7 +3,7 @@ "sourceIdentifier": "ics-cert@hq.dhs.gov", "published": "2025-06-09T23:15:22.110", "lastModified": "2025-06-12T16:06:39.330", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-305xx/CVE-2025-30515.json b/CVE-2025/CVE-2025-305xx/CVE-2025-30515.json index f81e69ded3e..a06ad30e2ad 100644 --- a/CVE-2025/CVE-2025-305xx/CVE-2025-30515.json +++ b/CVE-2025/CVE-2025-305xx/CVE-2025-30515.json @@ -3,7 +3,7 @@ "sourceIdentifier": "ics-cert@hq.dhs.gov", "published": "2025-06-09T23:15:22.273", "lastModified": "2025-06-12T16:06:39.330", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-306xx/CVE-2025-30665.json b/CVE-2025/CVE-2025-306xx/CVE-2025-30665.json index 9a86d697cb9..6f4347e1a9b 100644 --- a/CVE-2025/CVE-2025-306xx/CVE-2025-30665.json +++ b/CVE-2025/CVE-2025-306xx/CVE-2025-30665.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2025-05-14T18:15:30.317", "lastModified": "2025-05-16T14:43:56.797", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-306xx/CVE-2025-30666.json b/CVE-2025/CVE-2025-306xx/CVE-2025-30666.json index 0cba2221647..6d8d0cc2ea6 100644 --- a/CVE-2025/CVE-2025-306xx/CVE-2025-30666.json +++ b/CVE-2025/CVE-2025-306xx/CVE-2025-30666.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2025-05-14T18:15:30.447", "lastModified": "2025-05-16T14:43:56.797", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-307xx/CVE-2025-30749.json b/CVE-2025/CVE-2025-307xx/CVE-2025-30749.json index a3fe6b5959f..02666558165 100644 --- a/CVE-2025/CVE-2025-307xx/CVE-2025-30749.json +++ b/CVE-2025/CVE-2025-307xx/CVE-2025-30749.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Vulnerabilidad en Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition (componente 2D). Las versiones compatibles afectadas son Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM para JDK: 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Esta vulnerabilidad, dif\u00edcil de explotar, permite que un atacante no autenticado con acceso a la red a trav\u00e9s de m\u00faltiples protocolos comprometa Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition. Los ataques con \u00e9xito a esta vulnerabilidad pueden resultar en la toma de control de Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad afecta a implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start o applets Java en entornos aislados, que cargan y ejecutan c\u00f3digo no confiable (p. ej., c\u00f3digo proveniente de internet) y dependen del entorno aislado de Java para su seguridad. Esta vulnerabilidad no afecta a implementaciones de Java, generalmente en servidores, que cargan y ejecutan \u00fanicamente c\u00f3digo confiable (p. ej., c\u00f3digo instalado por un administrador). Puntuaci\u00f3n base de CVSS 3.1: 8.1 (Afecta a la confidencialidad, integridad y disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)." + "value": "Vulnerabilidad en Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition (componente 2D). Las versiones compatibles afectadas son Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM para JDK: 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Esta vulnerabilidad, dif\u00edcil de explotar, permite que un atacante no autenticado con acceso a la red a trav\u00e9s de m\u00faltiples protocolos comprometa Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition. Los ataques con \u00e9xito a esta vulnerabilidad pueden resultar en la toma de control de Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad afecta a implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start o applets Java en entornos aislados, que cargan y ejecutan c\u00f3digo no confiable (p. ej., c\u00f3digo proveniente de internet) y dependen del entorno de pruebas de Java para su seguridad. Esta vulnerabilidad no afecta a implementaciones de Java, generalmente en servidores, que cargan y ejecutan \u00fanicamente c\u00f3digo confiable (p. ej., c\u00f3digo instalado por un administrador). Puntuaci\u00f3n base de CVSS 3.1: 8.1 (Afecta a la confidencialidad, integridad y disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-307xx/CVE-2025-30752.json b/CVE-2025/CVE-2025-307xx/CVE-2025-30752.json index 64efd1a97e9..fb90fc6be5b 100644 --- a/CVE-2025/CVE-2025-307xx/CVE-2025-30752.json +++ b/CVE-2025/CVE-2025-307xx/CVE-2025-30752.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Vulnerabilidad en Oracle Java SE, Oracle GraalVM para JDK (componente: Compiler). La versi\u00f3n compatible afectada es Oracle Java SE: 24.0.1; Oracle GraalVM para JDK: 24.0.1. Esta vulnerabilidad, dif\u00edcil de explotar, permite a un atacante no autenticado con acceso a la red a trav\u00e9s de m\u00faltiples protocolos comprometer Oracle Java SE, Oracle GraalVM para JDK. Los ataques exitosos de esta vulnerabilidad pueden resultar en la capacidad no autorizada de causar una denegaci\u00f3n de servicio parcial (DOS parcial) de Oracle Java SE, Oracle GraalVM para JDK. Nota: Esta vulnerabilidad se aplica a implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start o subprogramas Java en entornos aislados, que cargan y ejecutan c\u00f3digo no confiable (por ejemplo, c\u00f3digo proveniente de internet) y dependen del entorno aislado de Java para su seguridad. Esta vulnerabilidad no se aplica a implementaciones de Java, generalmente en servidores, que cargan y ejecutan solo c\u00f3digo confiable (por ejemplo, c\u00f3digo instalado por un administrador). Puntuaci\u00f3n base CVSS 3.1: 3.7 (Impactos en la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)." + "value": "Vulnerabilidad en Oracle Java SE, Oracle GraalVM para JDK (componente: Compiler). La versi\u00f3n compatible afectada es Oracle Java SE: 24.0.1; Oracle GraalVM para JDK: 24.0.1. Esta vulnerabilidad, dif\u00edcil de explotar, permite a un atacante no autenticado con acceso a la red a trav\u00e9s de m\u00faltiples protocolos comprometer Oracle Java SE, Oracle GraalVM para JDK. Los ataques exitosos de esta vulnerabilidad pueden resultar en la capacidad no autorizada de causar una denegaci\u00f3n de servicio parcial (DOS parcial) de Oracle Java SE, Oracle GraalVM para JDK. Nota: Esta vulnerabilidad se aplica a implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start o subprogramas Java en entornos aislados, que cargan y ejecutan c\u00f3digo no confiable (por ejemplo, c\u00f3digo proveniente de internet) y dependen del entorno de pruebas de Java para su seguridad. Esta vulnerabilidad no se aplica a implementaciones de Java, generalmente en servidores, que cargan y ejecutan solo c\u00f3digo confiable (por ejemplo, c\u00f3digo instalado por un administrador). Puntuaci\u00f3n base CVSS 3.1: 3.7 (Impactos en la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-307xx/CVE-2025-30754.json b/CVE-2025/CVE-2025-307xx/CVE-2025-30754.json index b725b11f088..05f6f3a26a6 100644 --- a/CVE-2025/CVE-2025-307xx/CVE-2025-30754.json +++ b/CVE-2025/CVE-2025-307xx/CVE-2025-30754.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Vulnerabilidad en Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition (componente: JSSE). Las versiones compatibles afectadas son Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM para JDK: 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Esta vulnerabilidad, dif\u00edcil de explotar, permite que un atacante no autenticado con acceso a la red mediante TLS comprometa Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a actualizaciones, inserciones o eliminaciones de algunos datos accesibles de Oracle Java SE, Oracle GraalVM for JDK y Oracle GraalVM Enterprise Edition, as\u00ed como acceso no autorizado a lecturas de un subconjunto de dichos datos. Nota: Esta vulnerabilidad se aplica a implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start o subprogramas Java en entornos aislados, que cargan y ejecutan c\u00f3digo no confiable (p. ej., c\u00f3digo proveniente de internet) y dependen del entorno aislado de Java para su seguridad. Esta vulnerabilidad no se aplica a implementaciones de Java, generalmente en servidores, que cargan y ejecutan solo c\u00f3digo confiable (p. ej., c\u00f3digo instalado por un administrador). Puntuaci\u00f3n base de CVSS 3.1: 4.8 (impactos en la confidencialidad e integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)." + "value": "Vulnerabilidad en Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition (componente: JSSE). Las versiones compatibles afectadas son Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM para JDK: 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Esta vulnerabilidad, dif\u00edcil de explotar, permite que un atacante no autenticado con acceso a la red mediante TLS comprometa Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a actualizaciones, inserciones o eliminaciones de algunos datos accesibles de Oracle Java SE, Oracle GraalVM for JDK y Oracle GraalVM Enterprise Edition, as\u00ed como acceso no autorizado a lecturas de un subconjunto de dichos datos. Nota: Esta vulnerabilidad se aplica a implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start o subprogramas Java en entornos aislados, que cargan y ejecutan c\u00f3digo no confiable (p. ej., c\u00f3digo proveniente de internet) y dependen del entorno de pruebas de Java para su seguridad. Esta vulnerabilidad no se aplica a implementaciones de Java, generalmente en servidores, que cargan y ejecutan solo c\u00f3digo confiable (p. ej., c\u00f3digo instalado por un administrador). Puntuaci\u00f3n base de CVSS 3.1: 4.8 (impactos en la confidencialidad e integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-307xx/CVE-2025-30761.json b/CVE-2025/CVE-2025-307xx/CVE-2025-30761.json index c853c820fd8..1e826398415 100644 --- a/CVE-2025/CVE-2025-307xx/CVE-2025-30761.json +++ b/CVE-2025/CVE-2025-307xx/CVE-2025-30761.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Vulnerabilidad en Oracle Java SE, Oracle GraalVM Enterprise Edition (componente: Scripting). Las versiones compatibles afectadas son Oracle Java SE: 8u451, 8u451-perf y 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Esta vulnerabilidad, dif\u00edcil de explotar, permite a un atacante no autenticado con acceso a la red a trav\u00e9s de m\u00faltiples protocolos comprometer Oracle Java SE, Oracle GraalVM Enterprise Edition. Los ataques exitosos de esta vulnerabilidad pueden resultar en la creaci\u00f3n, eliminaci\u00f3n o modificaci\u00f3n no autorizada de datos cr\u00edticos o de todos los datos accesibles de Oracle Java SE, Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad puede explotarse mediante el uso de las API del componente especificado, por ejemplo, a trav\u00e9s de un servicio web que suministra datos a las API. Esta vulnerabilidad tambi\u00e9n afecta a las implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start o subprogramas Java en entornos aislados, que cargan y ejecutan c\u00f3digo no confiable (por ejemplo, c\u00f3digo proveniente de internet) y dependen del entorno aislado de Java para su seguridad. Puntuaci\u00f3n base CVSS 3.1: 5,9 (Impactos en la integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)." + "value": "Vulnerabilidad en Oracle Java SE, Oracle GraalVM Enterprise Edition (componente: Scripting). Las versiones compatibles afectadas son Oracle Java SE: 8u451, 8u451-perf y 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Esta vulnerabilidad, dif\u00edcil de explotar, permite a un atacante no autenticado con acceso a la red a trav\u00e9s de m\u00faltiples protocolos comprometer Oracle Java SE, Oracle GraalVM Enterprise Edition. Los ataques exitosos de esta vulnerabilidad pueden resultar en la creaci\u00f3n, eliminaci\u00f3n o modificaci\u00f3n no autorizada de datos cr\u00edticos o de todos los datos accesibles de Oracle Java SE, Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad puede explotarse mediante el uso de las API del componente especificado, por ejemplo, a trav\u00e9s de un servicio web que suministra datos a las API. Esta vulnerabilidad tambi\u00e9n afecta a las implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start o subprogramas Java en entornos aislados, que cargan y ejecutan c\u00f3digo no confiable (por ejemplo, c\u00f3digo proveniente de internet) y dependen del entorno de pruebas de Java para su seguridad. Puntuaci\u00f3n base CVSS 3.1: 5,9 (Impactos en la integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-317xx/CVE-2025-31716.json b/CVE-2025/CVE-2025-317xx/CVE-2025-31716.json index 2a85c7c1a9b..5abac8cb058 100644 --- a/CVE-2025/CVE-2025-317xx/CVE-2025-31716.json +++ b/CVE-2025/CVE-2025-317xx/CVE-2025-31716.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In bootloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed." + }, + { + "lang": "es", + "value": "En bootloader, existe una posible escritura fuera de los l\u00edmites debido a una comprobaci\u00f3n de los l\u00edmites incompleta. Esto podr\u00eda provocar una denegaci\u00f3n de servicio local sin necesidad de privilegios de ejecuci\u00f3n adicionales." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-319xx/CVE-2025-31952.json b/CVE-2025/CVE-2025-319xx/CVE-2025-31952.json index 2078c7f2bf3..e8755789005 100644 --- a/CVE-2025/CVE-2025-319xx/CVE-2025-31952.json +++ b/CVE-2025/CVE-2025-319xx/CVE-2025-31952.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access." + }, + { + "lang": "es", + "value": "HCL iAutomate se ve afectado por una expiraci\u00f3n de sesi\u00f3n insuficiente. Esto permite que los tokens permanezcan v\u00e1lidos indefinidamente a menos que se revoquen manualmente, lo que aumenta el riesgo de acceso no autorizado." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-319xx/CVE-2025-31953.json b/CVE-2025/CVE-2025-319xx/CVE-2025-31953.json index 2f026a97035..cc8175b3cda 100644 --- a/CVE-2025/CVE-2025-319xx/CVE-2025-31953.json +++ b/CVE-2025/CVE-2025-319xx/CVE-2025-31953.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unauthorized parties." + }, + { + "lang": "es", + "value": "HCL iAutomate incluye credenciales codificadas que pueden resultar en la posible exposici\u00f3n de datos confidenciales si son interceptadas o accedidas por terceros no autorizados." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-319xx/CVE-2025-31955.json b/CVE-2025/CVE-2025-319xx/CVE-2025-31955.json index 11f38d5c2a8..23fb14de502 100644 --- a/CVE-2025/CVE-2025-319xx/CVE-2025-31955.json +++ b/CVE-2025/CVE-2025-319xx/CVE-2025-31955.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information within the system." + }, + { + "lang": "es", + "value": "HCL iAutomate se ve afectado por una vulnerabilidad de exposici\u00f3n de datos confidenciales. Este problema podr\u00eda permitir el acceso no autorizado a informaci\u00f3n confidencial del sistema." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-320xx/CVE-2025-32019.json b/CVE-2025/CVE-2025-320xx/CVE-2025-32019.json index 086ed9b5ddc..c630196b753 100644 --- a/CVE-2025/CVE-2025-320xx/CVE-2025-32019.json +++ b/CVE-2025/CVE-2025-320xx/CVE-2025-32019.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3." + }, + { + "lang": "es", + "value": "Harbor es un proyecto de registro nativo en la nube, confiable y de c\u00f3digo abierto que almacena, firma y escanea contenido. Las versiones 2.11.2 y anteriores, as\u00ed como las versiones 2.12.0-rc1 y 2.13.0-rc1, contienen una vulnerabilidad que permite explotar el campo Markdown de la pesta\u00f1a de informaci\u00f3n para inyectar c\u00f3digo XSS. Esto se ha corregido en las versiones 2.11.3 y 2.12.3." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-324xx/CVE-2025-32429.json b/CVE-2025/CVE-2025-324xx/CVE-2025-32429.json index 8cdc0750504..c52e1c38745 100644 --- a/CVE-2025/CVE-2025-324xx/CVE-2025-32429.json +++ b/CVE-2025/CVE-2025-324xx/CVE-2025-32429.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1." + }, + { + "lang": "es", + "value": "La plataforma XWiki es una plataforma wiki gen\u00e9rica que ofrece servicios de ejecuci\u00f3n para aplicaciones desarrolladas sobre ella. En las versiones 9.4-rc-1 a 16.10.5 y 17.0.0-rc-1 a 17.2.2, cualquiera puede inyectar SQL mediante el par\u00e1metro sort de getdeleteddocuments.vm. Se inyecta tal cual como un valor ORDER BY. Esto se solucion\u00f3 en las versiones 16.10.6 y 17.3.0-rc-1." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-327xx/CVE-2025-32797.json b/CVE-2025/CVE-2025-327xx/CVE-2025-32797.json index 9f5659d3764..ce04e610bb6 100644 --- a/CVE-2025/CVE-2025-327xx/CVE-2025-32797.json +++ b/CVE-2025/CVE-2025-327xx/CVE-2025-32797.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-06-16T19:15:33.510", "lastModified": "2025-06-17T20:50:23.507", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-330xx/CVE-2025-33013.json b/CVE-2025/CVE-2025-330xx/CVE-2025-33013.json index cb2a2054f15..a9fc98aa949 100644 --- a/CVE-2025/CVE-2025-330xx/CVE-2025-33013.json +++ b/CVE-2025/CVE-2025-330xx/CVE-2025-33013.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release." + }, + { + "lang": "es", + "value": "IBM MQ Operator LTS 2.0.0 a 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 a 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0 y MQ Operator SC2 3.2.0 a 3.2.13 Container podr\u00edan divulgar informaci\u00f3n confidencial a un usuario local debido a una limpieza incorrecta de la memoria del mont\u00f3n antes del lanzamiento." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-330xx/CVE-2025-33020.json b/CVE-2025/CVE-2025-330xx/CVE-2025-33020.json index f0aec3066d4..0a159f779f1 100644 --- a/CVE-2025/CVE-2025-330xx/CVE-2025-33020.json +++ b/CVE-2025/CVE-2025-330xx/CVE-2025-33020.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 transmits sensitive information without encryption that could allow an attacker to obtain highly sensitive information." + }, + { + "lang": "es", + "value": "IBM Engineering Systems Design Rhapsody 9.0.2, 10.0 y 10.0.1 transmite informaci\u00f3n confidencial sin cifrado, lo que podr\u00eda permitir que un atacante obtenga informaci\u00f3n altamente confidencial." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-330xx/CVE-2025-33076.json b/CVE-2025/CVE-2025-330xx/CVE-2025-33076.json index 52b373ff0ca..5582945051f 100644 --- a/CVE-2025/CVE-2025-330xx/CVE-2025-33076.json +++ b/CVE-2025/CVE-2025-330xx/CVE-2025-33076.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system." + }, + { + "lang": "es", + "value": "IBM Engineering Systems Design Rhapsody 9.0.2, 10.0 y 10.0.1 es vulnerable a un desbordamiento de b\u00fafer basado en la pila, causado por una comprobaci\u00f3n incorrecta de los l\u00edmites. Un usuario local podr\u00eda desbordar el b\u00fafer y ejecutar c\u00f3digo arbitrario en el sistema." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-330xx/CVE-2025-33077.json b/CVE-2025/CVE-2025-330xx/CVE-2025-33077.json index 29ede7c8ea3..f7d22327461 100644 --- a/CVE-2025/CVE-2025-330xx/CVE-2025-33077.json +++ b/CVE-2025/CVE-2025-330xx/CVE-2025-33077.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system." + }, + { + "lang": "es", + "value": "IBM Engineering Systems Design Rhapsody 9.0.2, 10.0 y 10.0.1 es vulnerable a un desbordamiento de b\u00fafer basado en la pila, causado por una comprobaci\u00f3n incorrecta de los l\u00edmites. Un usuario local podr\u00eda desbordar el b\u00fafer y ejecutar c\u00f3digo arbitrario en el sistema." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-330xx/CVE-2025-33092.json b/CVE-2025/CVE-2025-330xx/CVE-2025-33092.json index 47fb5576fb6..6fb2905320c 100644 --- a/CVE-2025/CVE-2025-330xx/CVE-2025-33092.json +++ b/CVE-2025/CVE-2025-330xx/CVE-2025-33092.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@us.ibm.com", "published": "2025-07-29T19:15:45.487", "lastModified": "2025-07-31T18:42:56.503", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-331xx/CVE-2025-33109.json b/CVE-2025/CVE-2025-331xx/CVE-2025-33109.json index ca91c4f6484..e03de7223f4 100644 --- a/CVE-2025/CVE-2025-331xx/CVE-2025-33109.json +++ b/CVE-2025/CVE-2025-331xx/CVE-2025-33109.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 is vulnerable to a privilege escalation caused by an invalid database authority check. A bad actor could execute a database procedure or function without having all required permissions, in addition to causing denial of service for some database actions." + }, + { + "lang": "es", + "value": "IBM i 7.2, 7.3, 7.4, 7.5 y 7.6 es vulnerable a una escalada de privilegios causada por una comprobaci\u00f3n de autoridad de base de datos no v\u00e1lida. Un usuario malintencionado podr\u00eda ejecutar un procedimiento o funci\u00f3n de base de datos sin tener todos los permisos necesarios, adem\u00e1s de provocar una denegaci\u00f3n de servicio para algunas acciones de la base de datos." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-331xx/CVE-2025-33114.json b/CVE-2025/CVE-2025-331xx/CVE-2025-33114.json index 286440ed800..82e2e84321f 100644 --- a/CVE-2025/CVE-2025-331xx/CVE-2025-33114.json +++ b/CVE-2025/CVE-2025-331xx/CVE-2025-33114.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@us.ibm.com", "published": "2025-07-29T19:15:45.647", "lastModified": "2025-07-31T18:42:56.503", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-341xx/CVE-2025-34146.json b/CVE-2025/CVE-2025-341xx/CVE-2025-34146.json index 29f90c49268..3fcb61d0490 100644 --- a/CVE-2025/CVE-2025-341xx/CVE-2025-34146.json +++ b/CVE-2025/CVE-2025-341xx/CVE-2025-34146.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition or, under certain conditions, escape the sandboxed environment intended to restrict code execution. The vulnerability stems from insufficient prototype access checks in the sandbox\u2019s executor logic, particularly in the handling of JavaScript function objects returned." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de contaminaci\u00f3n de prototipos en las versiones de @nyariv/sandboxjs anteriores a la 0.8.23, que permite a los atacantes inyectar propiedades arbitrarias en Object.prototype mediante c\u00f3digo JavaScript manipulado. Esto puede provocar una denegaci\u00f3n de servicio (DoS) o, en ciertas circunstancias, escapar del entorno de pruebas dise\u00f1ado para restringir la ejecuci\u00f3n de c\u00f3digo. La vulnerabilidad se debe a comprobaciones de acceso de prototipos insuficientes en la l\u00f3gica del ejecutor de pruebas, especialmente en el manejo de los objetos de funci\u00f3n JavaScript devueltos." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-35xx/CVE-2025-3528.json b/CVE-2025/CVE-2025-35xx/CVE-2025-3528.json index a1684a50298..8075565b9f0 100644 --- a/CVE-2025/CVE-2025-35xx/CVE-2025-3528.json +++ b/CVE-2025/CVE-2025-35xx/CVE-2025-3528.json @@ -19,7 +19,7 @@ "cvssMetricV31": [ { "source": "secalert@redhat.com", - "type": "Primary", + "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", @@ -42,7 +42,7 @@ "weaknesses": [ { "source": "secalert@redhat.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2025/CVE-2025-360xx/CVE-2025-36005.json b/CVE-2025/CVE-2025-360xx/CVE-2025-36005.json index 622051017e3..f0051636e04 100644 --- a/CVE-2025/CVE-2025-360xx/CVE-2025-36005.json +++ b/CVE-2025/CVE-2025-360xx/CVE-2025-36005.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the proxy to the same hostname and port due to improper certificate validation." + }, + { + "lang": "es", + "value": "Internet Pass-Thru en IBM MQ Operator LTS 2.0.0 a 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 a 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0 y MQ Operator SC2 3.2.0 a 3.2.13 podr\u00eda permitir que un usuario malintencionado obtenga informaci\u00f3n confidencial de otra conexi\u00f3n de sesi\u00f3n TLS a trav\u00e9s del proxy al mismo nombre de host y puerto debido a una validaci\u00f3n de certificado incorrecta." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-360xx/CVE-2025-36010.json b/CVE-2025/CVE-2025-360xx/CVE-2025-36010.json index ebafc7125a1..5118a34861e 100644 --- a/CVE-2025/CVE-2025-360xx/CVE-2025-36010.json +++ b/CVE-2025/CVE-2025-360xx/CVE-2025-36010.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@us.ibm.com", "published": "2025-07-29T18:15:28.733", "lastModified": "2025-07-31T18:42:56.503", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-360xx/CVE-2025-36039.json b/CVE-2025/CVE-2025-360xx/CVE-2025-36039.json index 2066892e60c..d7daf8951df 100644 --- a/CVE-2025/CVE-2025-360xx/CVE-2025-36039.json +++ b/CVE-2025/CVE-2025-360xx/CVE-2025-36039.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@us.ibm.com", "published": "2025-07-31T00:15:26.347", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-360xx/CVE-2025-36040.json b/CVE-2025/CVE-2025-360xx/CVE-2025-36040.json index 0fc736d2040..bf46188048d 100644 --- a/CVE-2025/CVE-2025-360xx/CVE-2025-36040.json +++ b/CVE-2025/CVE-2025-360xx/CVE-2025-36040.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@us.ibm.com", "published": "2025-07-31T00:15:26.580", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-361xx/CVE-2025-36116.json b/CVE-2025/CVE-2025-361xx/CVE-2025-36116.json index d5c9bdc5e0e..442d196914b 100644 --- a/CVE-2025/CVE-2025-361xx/CVE-2025-36116.json +++ b/CVE-2025/CVE-2025-361xx/CVE-2025-36116.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that the user is not allowed to perform." + }, + { + "lang": "es", + "value": "La interfaz gr\u00e1fica de usuario de IBM Db2 Mirror para i 7.4, 7.5 y 7.6 se ve afectada por una vulnerabilidad de secuestro de WebSocket entre sitios. Al enviar una solicitud especialmente manipulada, un agente malicioso no autenticado podr\u00eda explotar esta vulnerabilidad para rastrear una conexi\u00f3n WebSocket existente y, posteriormente, realizar de forma remota operaciones no permitidas para el usuario." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-361xx/CVE-2025-36117.json b/CVE-2025/CVE-2025-361xx/CVE-2025-36117.json index f199d5e07b3..10e543f06ce 100644 --- a/CVE-2025/CVE-2025-361xx/CVE-2025-36117.json +++ b/CVE-2025/CVE-2025-361xx/CVE-2025-36117.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system." + }, + { + "lang": "es", + "value": "IBM Db2 Mirror para i 7.4, 7.5 y 7.6 no proh\u00edbe el ID de sesi\u00f3n despu\u00e9s de su uso, lo que podr\u00eda permitir que un usuario autenticado se haga pasar por otro usuario en el sistema." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-365xx/CVE-2025-36548.json b/CVE-2025/CVE-2025-365xx/CVE-2025-36548.json index 0bf87799090..0baf3cd6c3e 100644 --- a/CVE-2025/CVE-2025-365xx/CVE-2025-36548.json +++ b/CVE-2025/CVE-2025-365xx/CVE-2025-36548.json @@ -3,12 +3,16 @@ "sourceIdentifier": "talos-cna@cisco.com", "published": "2025-07-24T16:15:31.117", "lastModified": "2025-07-25T15:29:19.837", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de cross-site scripting (xss) en la funcionalidad del par\u00e1metro cancelUri del formulario de inicio de sesi\u00f3n de LoginWordPress de WWBN AVideo 14.4 y el commit 8a8954ff del maestro de desarrollo. Una solicitud HTTP especialmente manipulada puede provocar la ejecuci\u00f3n arbitraria de JavaScript. Un atacante puede hacer que un usuario visite una p\u00e1gina web para activar esta vulnerabilidad." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-365xx/CVE-2025-36563.json b/CVE-2025/CVE-2025-365xx/CVE-2025-36563.json index 663c48a2cb1..690b184cf3e 100644 --- a/CVE-2025/CVE-2025-365xx/CVE-2025-36563.json +++ b/CVE-2025/CVE-2025-365xx/CVE-2025-36563.json @@ -3,7 +3,7 @@ "sourceIdentifier": "vultures@jpcert.or.jp", "published": "2025-07-31T08:15:23.753", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-36xx/CVE-2025-3614.json b/CVE-2025/CVE-2025-36xx/CVE-2025-3614.json index b48c43e6534..18914d3d9d2 100644 --- a/CVE-2025/CVE-2025-36xx/CVE-2025-3614.json +++ b/CVE-2025/CVE-2025-36xx/CVE-2025-3614.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page." + }, + { + "lang": "es", + "value": "El complemento ElementsKit Elementor Addons and Templates para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del atributo URL de un widget personalizado en todas las versiones hasta la 3.5.2 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-36xx/CVE-2025-3669.json b/CVE-2025/CVE-2025-36xx/CVE-2025-3669.json index 3603abac237..dd43b094f31 100644 --- a/CVE-2025/CVE-2025-36xx/CVE-2025-3669.json +++ b/CVE-2025/CVE-2025-36xx/CVE-2025-3669.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "The Supreme Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's auto_qrcodesabb shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page." + }, + { + "lang": "es", + "value": "El complemento Supreme Addons for Beaver Builder para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del shortcode auto_qrcodesabb del complemento en todas las versiones hasta la 1.0.9 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-371xx/CVE-2025-37108.json b/CVE-2025/CVE-2025-371xx/CVE-2025-37108.json index 1921ca39085..67502995e73 100644 --- a/CVE-2025/CVE-2025-371xx/CVE-2025-37108.json +++ b/CVE-2025/CVE-2025-371xx/CVE-2025-37108.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product" + }, + { + "lang": "es", + "value": "Se ha identificado una vulnerabilidad de cross-site scripting en el producto HPE Telco Service Activator" } ], "metrics": { diff --git a/CVE-2025/CVE-2025-371xx/CVE-2025-37109.json b/CVE-2025/CVE-2025-371xx/CVE-2025-37109.json index 73dc04d9885..0aae306791d 100644 --- a/CVE-2025/CVE-2025-371xx/CVE-2025-37109.json +++ b/CVE-2025/CVE-2025-371xx/CVE-2025-37109.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product" + }, + { + "lang": "es", + "value": "Se ha identificado una vulnerabilidad de cross-site scripting en el producto HPE Telco Service Activator" } ], "metrics": { diff --git a/CVE-2025/CVE-2025-371xx/CVE-2025-37110.json b/CVE-2025/CVE-2025-371xx/CVE-2025-37110.json index 4b34ec5fe9a..39b8097b6f2 100644 --- a/CVE-2025/CVE-2025-371xx/CVE-2025-37110.json +++ b/CVE-2025/CVE-2025-371xx/CVE-2025-37110.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 una vulnerabilidad en la pol\u00edtica de almacenamiento para ciertos conjuntos de informaci\u00f3n confidencial de credenciales en HPE Telco Network Function Virtual Orchestrator. Una explotaci\u00f3n exitosa podr\u00eda permitir que terceros no autorizados accedan a informaci\u00f3n confidencial del sistema." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-371xx/CVE-2025-37111.json b/CVE-2025/CVE-2025-371xx/CVE-2025-37111.json index e5a2dded5ce..54d9b212d6b 100644 --- a/CVE-2025/CVE-2025-371xx/CVE-2025-37111.json +++ b/CVE-2025/CVE-2025-371xx/CVE-2025-37111.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 una vulnerabilidad en la pol\u00edtica de almacenamiento de ciertos conjuntos de claves de autenticaci\u00f3n en HPE Telco Network Function Virtual Orchestrator. Una explotaci\u00f3n exitosa podr\u00eda permitir que terceros no autorizados accedan a informaci\u00f3n confidencial del sistema." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-371xx/CVE-2025-37112.json b/CVE-2025/CVE-2025-371xx/CVE-2025-37112.json index efad7d0c1ce..af8d2f24321 100644 --- a/CVE-2025/CVE-2025-371xx/CVE-2025-37112.json +++ b/CVE-2025/CVE-2025-371xx/CVE-2025-37112.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 una vulnerabilidad en la pol\u00edtica de almacenamiento para ciertos conjuntos de claves de cifrado en HPE Telco Network Function Virtual Orchestrator. Una explotaci\u00f3n exitosa podr\u00eda permitir que terceros no autorizados accedan a informaci\u00f3n confidencial del sistema." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38353.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38353.json index 3aa82c8a29e..c07e9b676af 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38353.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38353.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix taking invalid lock on wedge\n\nIf device wedges on e.g. GuC upload, the submission is not yet enabled\nand the state is not even initialized. Protect the wedge call so it does\nnothing in this case. It fixes the following splat:\n\n\t[] xe 0000:bf:00.0: [drm] device wedged, needs recovery\n\t[] ------------[ cut here ]------------\n\t[] DEBUG_LOCKS_WARN_ON(lock->magic != lock)\n\t[] WARNING: CPU: 48 PID: 312 at kernel/locking/mutex.c:564 __mutex_lock+0x8a1/0xe60\n\t...\n\t[] RIP: 0010:__mutex_lock+0x8a1/0xe60\n\t[] mutex_lock_nested+0x1b/0x30\n\t[] xe_guc_submit_wedge+0x80/0x2b0 [xe]" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/xe: Se corrige la toma de un bloqueo no v\u00e1lido en una cu\u00f1a. Si el dispositivo realiza una cu\u00f1a durante, por ejemplo, la carga de GuC, el env\u00edo a\u00fan no est\u00e1 habilitado y el estado ni siquiera se inicializa. Se protege la llamada a la cu\u00f1a para que no haga nada en este caso. Corrige el siguiente problema: [] xe 0000:bf:00.0: [drm] device wedged, needs recovery [] ------------[ cut here ]------------ [] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [] WARNING: CPU: 48 PID: 312 at kernel/locking/mutex.c:564 __mutex_lock+0x8a1/0xe60 ... [] RIP: 0010:__mutex_lock+0x8a1/0xe60 [] mutex_lock_nested+0x1b/0x30 [] xe_guc_submit_wedge+0x80/0x2b0 [xe]" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38354.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38354.json index 6168d9b438a..9bd603f6404 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38354.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38354.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/gpu: Fix crash when throttling GPU immediately during boot\n\nThere is a small chance that the GPU is already hot during boot. In that\ncase, the call to of_devfreq_cooling_register() will immediately try to\napply devfreq cooling, as seen in the following crash:\n\n Unable to handle kernel paging request at virtual address 0000000000014110\n pc : a6xx_gpu_busy+0x1c/0x58 [msm]\n lr : msm_devfreq_get_dev_status+0xbc/0x140 [msm]\n Call trace:\n a6xx_gpu_busy+0x1c/0x58 [msm] (P)\n devfreq_simple_ondemand_func+0x3c/0x150\n devfreq_update_target+0x44/0xd8\n qos_max_notifier_call+0x30/0x84\n blocking_notifier_call_chain+0x6c/0xa0\n pm_qos_update_target+0xd0/0x110\n freq_qos_apply+0x3c/0x74\n apply_constraint+0x88/0x148\n __dev_pm_qos_update_request+0x7c/0xcc\n dev_pm_qos_update_request+0x38/0x5c\n devfreq_cooling_set_cur_state+0x98/0xf0\n __thermal_cdev_update+0x64/0xb4\n thermal_cdev_update+0x4c/0x58\n step_wise_manage+0x1f0/0x318\n __thermal_zone_device_update+0x278/0x424\n __thermal_cooling_device_register+0x2bc/0x308\n thermal_of_cooling_device_register+0x10/0x1c\n of_devfreq_cooling_register_power+0x240/0x2bc\n of_devfreq_cooling_register+0x14/0x20\n msm_devfreq_init+0xc4/0x1a0 [msm]\n msm_gpu_init+0x304/0x574 [msm]\n adreno_gpu_init+0x1c4/0x2e0 [msm]\n a6xx_gpu_init+0x5c8/0x9c8 [msm]\n adreno_bind+0x2a8/0x33c [msm]\n ...\n\nAt this point we haven't initialized the GMU at all yet, so we cannot read\nthe GMU registers inside a6xx_gpu_busy(). A similar issue was fixed before\nin commit 6694482a70e9 (\"drm/msm: Avoid unclocked GMU register access in\n6xx gpu_busy\"): msm_devfreq_init() does call devfreq_suspend_device(), but\nunlike msm_devfreq_suspend(), it doesn't set the df->suspended flag\naccordingly. This means the df->suspended flag does not match the actual\ndevfreq state after initialization and msm_devfreq_get_dev_status() will\nend up accessing GMU registers, causing the crash.\n\nFix this by setting df->suspended correctly during initialization.\n\nPatchwork: https://patchwork.freedesktop.org/patch/650772/" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/msm/gpu: se corrige el fallo que se produce al limitar la GPU inmediatamente durante el arranque. Existe una peque\u00f1a posibilidad de que la GPU ya est\u00e9 caliente durante el arranque. En ese caso, la llamada a of_devfreq_cooling_register() intentar\u00e1 inmediatamente aplicar el enfriamiento devfreq, como se ve en el siguiente fallo: No se puede manejar la solicitud de paginaci\u00f3n del kernel en la direcci\u00f3n virtual 0000000000014110 pc : a6xx_gpu_busy+0x1c/0x58 [msm] lr : msm_devfreq_get_dev_status+0xbc/0x140 [msm] Call trace: a6xx_gpu_busy+0x1c/0x58 [msm] (P) devfreq_simple_ondemand_func+0x3c/0x150 devfreq_update_target+0x44/0xd8 qos_max_notifier_call+0x30/0x84 blocking_notifier_call_chain+0x6c/0xa0 pm_qos_update_target+0xd0/0x110 freq_qos_apply+0x3c/0x74 apply_constraint+0x88/0x148 __dev_pm_qos_update_request+0x7c/0xcc dev_pm_qos_update_request+0x38/0x5c devfreq_cooling_set_cur_state+0x98/0xf0 __thermal_cdev_update+0x64/0xb4 thermal_cdev_update+0x4c/0x58 step_wise_manage+0x1f0/0x318 __thermal_zone_device_update+0x278/0x424 __thermal_cooling_device_register+0x2bc/0x308 thermal_of_cooling_device_register+0x10/0x1c of_devfreq_cooling_register_power+0x240/0x2bc of_devfreq_cooling_register+0x14/0x20 msm_devfreq_init+0xc4/0x1a0 [msm] msm_gpu_init+0x304/0x574 [msm] adreno_gpu_init+0x1c4/0x2e0 [msm] a6xx_gpu_init+0x5c8/0x9c8 [msm] adreno_bind+0x2a8/0x33c [msm] ... En este punto, a\u00fan no hemos inicializado la GMU en absoluto, por lo que no podemos leer los registros de la GMU dentro de a6xx_gpu_busy(). Un problema similar se solucion\u00f3 previamente en el commit 6694482a70e9 (\"drm/msm: Evitar el acceso a registros de GMU sin reloj en 6xx gpu_busy\"): msm_devfreq_init() llama a devfreq_suspend_device(), pero a diferencia de msm_devfreq_suspend(), no establece el indicador df->suspended como corresponde. Esto significa que el indicador df->suspended no coincide con el estado real de devfreq tras la inicializaci\u00f3n y msm_devfreq_get_dev_status() acceder\u00e1 a los registros de GMU, lo que provocar\u00e1 el bloqueo. Para solucionarlo, configure df->suspended correctamente durante la inicializaci\u00f3n. Patchwork: https://patchwork.freedesktop.org/patch/650772/" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38355.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38355.json index 377b88e2d6c..45cc3e349a1 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38355.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38355.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Process deferred GGTT node removals on device unwind\n\nWhile we are indirectly draining our dedicated workqueue ggtt->wq\nthat we use to complete asynchronous removal of some GGTT nodes,\nthis happends as part of the managed-drm unwinding (ggtt_fini_early),\nwhich could be later then manage-device unwinding, where we could\nalready unmap our MMIO/GMS mapping (mmio_fini).\n\nThis was recently observed during unsuccessful VF initialization:\n\n [ ] xe 0000:00:02.1: probe with driver xe failed with error -62\n [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747340 __xe_bo_unpin_map_no_vm (16 bytes)\n [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747540 __xe_bo_unpin_map_no_vm (16 bytes)\n [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747240 __xe_bo_unpin_map_no_vm (16 bytes)\n [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747040 tiles_fini (16 bytes)\n [ ] xe 0000:00:02.1: DEVRES REL ffff88811e746840 mmio_fini (16 bytes)\n [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747f40 xe_bo_pinned_fini (16 bytes)\n [ ] xe 0000:00:02.1: DEVRES REL ffff88811e746b40 devm_drm_dev_init_release (16 bytes)\n [ ] xe 0000:00:02.1: [drm:drm_managed_release] drmres release begin\n [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef81640 __fini_relay (8 bytes)\n [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80d40 guc_ct_fini (8 bytes)\n [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80040 __drmm_mutex_release (8 bytes)\n [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80140 ggtt_fini_early (8 bytes)\n\nand this was leading to:\n\n [ ] BUG: unable to handle page fault for address: ffffc900058162a0\n [ ] #PF: supervisor write access in kernel mode\n [ ] #PF: error_code(0x0002) - not-present page\n [ ] Oops: Oops: 0002 [#1] SMP NOPTI\n [ ] Tainted: [W]=WARN\n [ ] Workqueue: xe-ggtt-wq ggtt_node_remove_work_func [xe]\n [ ] RIP: 0010:xe_ggtt_set_pte+0x6d/0x350 [xe]\n [ ] Call Trace:\n [ ] \n [ ] xe_ggtt_clear+0xb0/0x270 [xe]\n [ ] ggtt_node_remove+0xbb/0x120 [xe]\n [ ] ggtt_node_remove_work_func+0x30/0x50 [xe]\n [ ] process_one_work+0x22b/0x6f0\n [ ] worker_thread+0x1e8/0x3d\n\nAdd managed-device action that will explicitly drain the workqueue\nwith all pending node removals prior to releasing MMIO/GSM mapping.\n\n(cherry picked from commit 89d2835c3680ab1938e22ad81b1c9f8c686bd391)" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/xe: Proceso diferido de eliminaciones de nodos GGTT al desenrollar el dispositivo Mientras drenamos indirectamente nuestra cola de trabajo dedicada ggtt->wq que usamos para completar la eliminaci\u00f3n asincr\u00f3nica de algunos nodos GGTT, esto sucede como parte del desenrollado de managed-drm (ggtt_fini_early), que podr\u00eda ser posterior al desenrollado de managed-device, donde ya podr\u00edamos desasignar nuestra asignaci\u00f3n MMIO/GMS (mmio_fini). Esto se observ\u00f3 recientemente durante una inicializaci\u00f3n de VF fallida: [ ] xe 0000:00:02.1: probe with driver xe failed with error -62 [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747340 __xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747540 __xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747240 __xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747040 tiles_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e746840 mmio_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747f40 xe_bo_pinned_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e746b40 devm_drm_dev_init_release (16 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] drmres release begin [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef81640 __fini_relay (8 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80d40 guc_ct_fini (8 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80040 __drmm_mutex_release (8 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80140 ggtt_fini_early (8 bytes) and this was leading to: [ ] BUG: unable to handle page fault for address: ffffc900058162a0 [ ] #PF: supervisor write access in kernel mode [ ] #PF: error_code(0x0002) - not-present page [ ] Oops: Oops: 0002 [#1] SMP NOPTI [ ] Tainted: [W]=WARN [ ] Workqueue: xe-ggtt-wq ggtt_node_remove_work_func [xe] [ ] RIP: 0010:xe_ggtt_set_pte+0x6d/0x350 [xe] [ ] Call Trace: [ ] [ ] xe_ggtt_clear+0xb0/0x270 [xe] [ ] ggtt_node_remove+0xbb/0x120 [xe] [ ] ggtt_node_remove_work_func+0x30/0x50 [xe] [ ] process_one_work+0x22b/0x6f0 [ ] worker_thread+0x1e8/0x3d Se agreg\u00f3 una acci\u00f3n de dispositivo administrado que drenar\u00e1 expl\u00edcitamente la cola de trabajo con todas las eliminaciones de nodos pendientes antes de liberar la asignaci\u00f3n de MMIO/GSM. (Seleccionado del commit 89d2835c3680ab1938e22ad81b1c9f8c686bd391)" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38356.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38356.json index de4ddf73b39..dbcae802525 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38356.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38356.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Explicitly exit CT safe mode on unwind\n\nDuring driver probe we might be briefly using CT safe mode, which\nis based on a delayed work, but usually we are able to stop this\nonce we have IRQ fully operational. However, if we abort the probe\nquite early then during unwind we might try to destroy the workqueue\nwhile there is still a pending delayed work that attempts to restart\nitself which triggers a WARN.\n\nThis was recently observed during unsuccessful VF initialization:\n\n [ ] xe 0000:00:02.1: probe with driver xe failed with error -62\n [ ] ------------[ cut here ]------------\n [ ] workqueue: cannot queue safe_mode_worker_func [xe] on wq xe-g2h-wq\n [ ] WARNING: CPU: 9 PID: 0 at kernel/workqueue.c:2257 __queue_work+0x287/0x710\n [ ] RIP: 0010:__queue_work+0x287/0x710\n [ ] Call Trace:\n [ ] delayed_work_timer_fn+0x19/0x30\n [ ] call_timer_fn+0xa1/0x2a0\n\nExit the CT safe mode on unwind to avoid that warning.\n\n(cherry picked from commit 2ddbb73ec20b98e70a5200cb85deade22ccea2ec)" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/xe/guc: Salida expl\u00edcita del modo seguro CT al desenrollar. Durante la prueba del controlador, podr\u00edamos usar brevemente el modo seguro CT, que se basa en un trabajo retrasado, pero normalmente podemos detenerlo una vez que IRQ est\u00e9 completamente operativo. Sin embargo, si cancelamos la prueba antes de tiempo, durante la desenrollaci\u00f3n podr\u00edamos intentar destruir la cola de trabajos mientras a\u00fan haya un trabajo retrasado pendiente que intenta reiniciarse, lo que activa una advertencia. Esto se observ\u00f3 recientemente durante una inicializaci\u00f3n de VF fallida: [ ] xe 0000:00:02.1: probe with driver xe failed with error -62 [ ] ------------[ cut here ]------------ [ ] workqueue: cannot queue safe_mode_worker_func [xe] on wq xe-g2h-wq [ ] WARNING: CPU: 9 PID: 0 at kernel/workqueue.c:2257 __queue_work+0x287/0x710 [ ] RIP: 0010:__queue_work+0x287/0x710 [ ] Call Trace: [ ] delayed_work_timer_fn+0x19/0x30 [ ] call_timer_fn+0xa1/0x2a0 Salga del modo seguro de CT al desenrollar para evitar esa advertencia. (seleccionado del commit 2ddbb73ec20b98e70a5200cb85deade22ccea2ec)" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38357.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38357.json index bae9da25638..794100acf59 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38357.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38357.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix runtime warning on truncate_folio_batch_exceptionals()\n\nThe WARN_ON_ONCE is introduced on truncate_folio_batch_exceptionals() to\ncapture whether the filesystem has removed all DAX entries or not.\n\nAnd the fix has been applied on the filesystem xfs and ext4 by the commit\n0e2f80afcfa6 (\"fs/dax: ensure all pages are idle prior to filesystem\nunmount\").\n\nApply the missed fix on filesystem fuse to fix the runtime warning:\n\n[ 2.011450] ------------[ cut here ]------------\n[ 2.011873] WARNING: CPU: 0 PID: 145 at mm/truncate.c:89 truncate_folio_batch_exceptionals+0x272/0x2b0\n[ 2.012468] Modules linked in:\n[ 2.012718] CPU: 0 UID: 1000 PID: 145 Comm: weston Not tainted 6.16.0-rc2-WSL2-STABLE #2 PREEMPT(undef)\n[ 2.013292] RIP: 0010:truncate_folio_batch_exceptionals+0x272/0x2b0\n[ 2.013704] Code: 48 63 d0 41 29 c5 48 8d 1c d5 00 00 00 00 4e 8d 6c 2a 01 49 c1 e5 03 eb 09 48 83 c3 08 49 39 dd 74 83 41 f6 44 1c 08 01 74 ef <0f> 0b 49 8b 34 1e 48 89 ef e8 10 a2 17 00 eb df 48 8b 7d 00 e8 35\n[ 2.014845] RSP: 0018:ffffa47ec33f3b10 EFLAGS: 00010202\n[ 2.015279] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[ 2.015884] RDX: 0000000000000000 RSI: ffffa47ec33f3ca0 RDI: ffff98aa44f3fa80\n[ 2.016377] RBP: ffff98aa44f3fbf0 R08: ffffa47ec33f3ba8 R09: 0000000000000000\n[ 2.016942] R10: 0000000000000001 R11: 0000000000000000 R12: ffffa47ec33f3ca0\n[ 2.017437] R13: 0000000000000008 R14: ffffa47ec33f3ba8 R15: 0000000000000000\n[ 2.017972] FS: 000079ce006afa40(0000) GS:ffff98aade441000(0000) knlGS:0000000000000000\n[ 2.018510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 2.018987] CR2: 000079ce03e74000 CR3: 000000010784f006 CR4: 0000000000372eb0\n[ 2.019518] Call Trace:\n[ 2.019729] \n[ 2.019901] truncate_inode_pages_range+0xd8/0x400\n[ 2.020280] ? timerqueue_add+0x66/0xb0\n[ 2.020574] ? get_nohz_timer_target+0x2a/0x140\n[ 2.020904] ? timerqueue_add+0x66/0xb0\n[ 2.021231] ? timerqueue_del+0x2e/0x50\n[ 2.021646] ? __remove_hrtimer+0x39/0x90\n[ 2.022017] ? srso_alias_untrain_ret+0x1/0x10\n[ 2.022497] ? psi_group_change+0x136/0x350\n[ 2.023046] ? _raw_spin_unlock+0xe/0x30\n[ 2.023514] ? finish_task_switch.isra.0+0x8d/0x280\n[ 2.024068] ? __schedule+0x532/0xbd0\n[ 2.024551] fuse_evict_inode+0x29/0x190\n[ 2.025131] evict+0x100/0x270\n[ 2.025641] ? _atomic_dec_and_lock+0x39/0x50\n[ 2.026316] ? __pfx_generic_delete_inode+0x10/0x10\n[ 2.026843] __dentry_kill+0x71/0x180\n[ 2.027335] dput+0xeb/0x1b0\n[ 2.027725] __fput+0x136/0x2b0\n[ 2.028054] __x64_sys_close+0x3d/0x80\n[ 2.028469] do_syscall_64+0x6d/0x1b0\n[ 2.028832] ? clear_bhb_loop+0x30/0x80\n[ 2.029182] ? clear_bhb_loop+0x30/0x80\n[ 2.029533] ? clear_bhb_loop+0x30/0x80\n[ 2.029902] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 2.030423] RIP: 0033:0x79ce03d0d067\n[ 2.030820] Code: b8 ff ff ff ff e9 3e ff ff ff 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 c3 a7 f8 ff\n[ 2.032354] RSP: 002b:00007ffef0498948 EFLAGS: 00000246 ORIG_RAX: 0000000000000003\n[ 2.032939] RAX: ffffffffffffffda RBX: 00007ffef0498960 RCX: 000079ce03d0d067\n[ 2.033612] RDX: 0000000000000003 RSI: 0000000000001000 RDI: 000000000000000d\n[ 2.034289] RBP: 00007ffef0498a30 R08: 000000000000000d R09: 0000000000000000\n[ 2.034944] R10: 00007ffef0498978 R11: 0000000000000246 R12: 0000000000000001\n[ 2.035610] R13: 00007ffef0498960 R14: 000079ce03e09ce0 R15: 0000000000000003\n[ 2.036301] \n[ 2.036532] ---[ end trace 0000000000000000 ]---" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fuse: correcci\u00f3n de la advertencia de tiempo de ejecuci\u00f3n en truncate_folio_batch_exceptionals(). Se introduce WARN_ON_ONCE en truncate_folio_batch_exceptionals() para detectar si el sistema de archivos ha eliminado todas las entradas DAX. La correcci\u00f3n se ha aplicado a los sistemas de archivos xfs y ext4 mediante el commit 0e2f80afcfa6 (\"fs/dax: asegurar que todas las p\u00e1ginas est\u00e9n inactivas antes de desmontar el sistema de archivos\"). Aplique la correcci\u00f3n que falt\u00f3 en el fusible del sistema de archivos para corregir la advertencia de tiempo de ejecuci\u00f3n: [ 2.011450] ------------[ cut here ]------------ [ 2.011873] WARNING: CPU: 0 PID: 145 at mm/truncate.c:89 truncate_folio_batch_exceptionals+0x272/0x2b0 [ 2.012468] Modules linked in: [ 2.012718] CPU: 0 UID: 1000 PID: 145 Comm: weston Not tainted 6.16.0-rc2-WSL2-STABLE #2 PREEMPT(undef) [ 2.013292] RIP: 0010:truncate_folio_batch_exceptionals+0x272/0x2b0 [ 2.013704] Code: 48 63 d0 41 29 c5 48 8d 1c d5 00 00 00 00 4e 8d 6c 2a 01 49 c1 e5 03 eb 09 48 83 c3 08 49 39 dd 74 83 41 f6 44 1c 08 01 74 ef <0f> 0b 49 8b 34 1e 48 89 ef e8 10 a2 17 00 eb df 48 8b 7d 00 e8 35 [ 2.014845] RSP: 0018:ffffa47ec33f3b10 EFLAGS: 00010202 [ 2.015279] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 2.015884] RDX: 0000000000000000 RSI: ffffa47ec33f3ca0 RDI: ffff98aa44f3fa80 [ 2.016377] RBP: ffff98aa44f3fbf0 R08: ffffa47ec33f3ba8 R09: 0000000000000000 [ 2.016942] R10: 0000000000000001 R11: 0000000000000000 R12: ffffa47ec33f3ca0 [ 2.017437] R13: 0000000000000008 R14: ffffa47ec33f3ba8 R15: 0000000000000000 [ 2.017972] FS: 000079ce006afa40(0000) GS:ffff98aade441000(0000) knlGS:0000000000000000 [ 2.018510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2.018987] CR2: 000079ce03e74000 CR3: 000000010784f006 CR4: 0000000000372eb0 [ 2.019518] Call Trace: [ 2.019729] [ 2.019901] truncate_inode_pages_range+0xd8/0x400 [ 2.020280] ? timerqueue_add+0x66/0xb0 [ 2.020574] ? get_nohz_timer_target+0x2a/0x140 [ 2.020904] ? timerqueue_add+0x66/0xb0 [ 2.021231] ? timerqueue_del+0x2e/0x50 [ 2.021646] ? __remove_hrtimer+0x39/0x90 [ 2.022017] ? srso_alias_untrain_ret+0x1/0x10 [ 2.022497] ? psi_group_change+0x136/0x350 [ 2.023046] ? _raw_spin_unlock+0xe/0x30 [ 2.023514] ? finish_task_switch.isra.0+0x8d/0x280 [ 2.024068] ? __schedule+0x532/0xbd0 [ 2.024551] fuse_evict_inode+0x29/0x190 [ 2.025131] evict+0x100/0x270 [ 2.025641] ? _atomic_dec_and_lock+0x39/0x50 [ 2.026316] ? __pfx_generic_delete_inode+0x10/0x10 [ 2.026843] __dentry_kill+0x71/0x180 [ 2.027335] dput+0xeb/0x1b0 [ 2.027725] __fput+0x136/0x2b0 [ 2.028054] __x64_sys_close+0x3d/0x80 [ 2.028469] do_syscall_64+0x6d/0x1b0 [ 2.028832] ? clear_bhb_loop+0x30/0x80 [ 2.029182] ? clear_bhb_loop+0x30/0x80 [ 2.029533] ? clear_bhb_loop+0x30/0x80 [ 2.029902] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 2.030423] RIP: 0033:0x79ce03d0d067 [ 2.030820] Code: b8 ff ff ff ff e9 3e ff ff ff 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 c3 a7 f8 ff [ 2.032354] RSP: 002b:00007ffef0498948 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 2.032939] RAX: ffffffffffffffda RBX: 00007ffef0498960 RCX: 000079ce03d0d067 [ 2.033612] RDX: 0000000000000003 RSI: 0000000000001000 RDI: 000000000000000d [ 2.034289] RBP: 00007ffef0498a30 R08: 000000000000000d R09: 0000000000000000 [ 2.034944] R10: 00007ffef0498978 R11: 0000000000000246 R12: 0000000000000001 [ 2.035610] R13: 00007ffef0498960 R14: 000079ce03e09ce0 R15: 0000000000000003 [ 2.036301] [ 2.036532] ---[ end trace 0000000000000000 ]---" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38358.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38358.json index 5f3083f83c7..31becb930f1 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38358.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38358.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race between async reclaim worker and close_ctree()\n\nSyzbot reported an assertion failure due to an attempt to add a delayed\niput after we have set BTRFS_FS_STATE_NO_DELAYED_IPUT in the fs_info\nstate:\n\n WARNING: CPU: 0 PID: 65 at fs/btrfs/inode.c:3420 btrfs_add_delayed_iput+0x2f8/0x370 fs/btrfs/inode.c:3420\n Modules linked in:\n CPU: 0 UID: 0 PID: 65 Comm: kworker/u8:4 Not tainted 6.15.0-next-20250530-syzkaller #0 PREEMPT(full)\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\n Workqueue: btrfs-endio-write btrfs_work_helper\n RIP: 0010:btrfs_add_delayed_iput+0x2f8/0x370 fs/btrfs/inode.c:3420\n Code: 4e ad 5d (...)\n RSP: 0018:ffffc9000213f780 EFLAGS: 00010293\n RAX: ffffffff83c635b7 RBX: ffff888058920000 RCX: ffff88801c769e00\n RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000000\n RBP: 0000000000000001 R08: ffff888058921b67 R09: 1ffff1100b12436c\n R10: dffffc0000000000 R11: ffffed100b12436d R12: 0000000000000001\n R13: dffffc0000000000 R14: ffff88807d748000 R15: 0000000000000100\n FS: 0000000000000000(0000) GS:ffff888125c53000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00002000000bd038 CR3: 000000006a142000 CR4: 00000000003526f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n \n btrfs_put_ordered_extent+0x19f/0x470 fs/btrfs/ordered-data.c:635\n btrfs_finish_one_ordered+0x11d8/0x1b10 fs/btrfs/inode.c:3312\n btrfs_work_helper+0x399/0xc20 fs/btrfs/async-thread.c:312\n process_one_work kernel/workqueue.c:3238 [inline]\n process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402\n kthread+0x70e/0x8a0 kernel/kthread.c:464\n ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \n\nThis can happen due to a race with the async reclaim worker like this:\n\n1) The async metadata reclaim worker enters shrink_delalloc(), which calls\n btrfs_start_delalloc_roots() with an nr_pages argument that has a value\n less than LONG_MAX, and that in turn enters start_delalloc_inodes(),\n which sets the local variable 'full_flush' to false because\n wbc->nr_to_write is less than LONG_MAX;\n\n2) There it finds inode X in a root's delalloc list, grabs a reference for\n inode X (with igrab()), and triggers writeback for it with\n filemap_fdatawrite_wbc(), which creates an ordered extent for inode X;\n\n3) The unmount sequence starts from another task, we enter close_ctree()\n and we flush the workqueue fs_info->endio_write_workers, which waits\n for the ordered extent for inode X to complete and when dropping the\n last reference of the ordered extent, with btrfs_put_ordered_extent(),\n when we call btrfs_add_delayed_iput() we don't add the inode to the\n list of delayed iputs because it has a refcount of 2, so we decrement\n it to 1 and return;\n\n4) Shortly after at close_ctree() we call btrfs_run_delayed_iputs() which\n runs all delayed iputs, and then we set BTRFS_FS_STATE_NO_DELAYED_IPUT\n in the fs_info state;\n\n5) The async reclaim worker, after calling filemap_fdatawrite_wbc(), now\n calls btrfs_add_delayed_iput() for inode X and there we trigger an\n assertion failure since the fs_info state has the flag\n BTRFS_FS_STATE_NO_DELAYED_IPUT set.\n\nFix this by setting BTRFS_FS_STATE_NO_DELAYED_IPUT only after we wait for\nthe async reclaim workers to finish, after we call cancel_work_sync() for\nthem at close_ctree(), and by running delayed iputs after wait for the\nreclaim workers to finish and before setting the bit.\n\nThis race was recently introduced by commit 19e60b2a95f5 (\"btrfs: add\nextra warning if delayed iput is added when it's not allowed\"). Without\nthe new validation at btrfs_add_delayed_iput(), \n---truncated---" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: correcci\u00f3n de la ejecuci\u00f3n entre el trabajador de recuperaci\u00f3n as\u00edncrono y close_ctree() Syzbot inform\u00f3 de un error de aserci\u00f3n debido a un intento de agregar una entrada retrasada despu\u00e9s de que hayamos establecido BTRFS_FS_STATE_NO_DELAYED_IPUT en el estado WARNING: CPU: 0 PID: 65 at fs/btrfs/inode.c:3420 btrfs_add_delayed_iput+0x2f8/0x370 fs/btrfs/inode.c:3420 Modules linked in: CPU: 0 UID: 0 PID: 65 Comm: kworker/u8:4 Not tainted 6.15.0-next-20250530-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: btrfs-endio-write btrfs_work_helper RIP: 0010:btrfs_add_delayed_iput+0x2f8/0x370 fs/btrfs/inode.c:3420 Code: 4e ad 5d (...) RSP: 0018:ffffc9000213f780 EFLAGS: 00010293 RAX: ffffffff83c635b7 RBX: ffff888058920000 RCX: ffff88801c769e00 RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000000 RBP: 0000000000000001 R08: ffff888058921b67 R09: 1ffff1100b12436c R10: dffffc0000000000 R11: ffffed100b12436d R12: 0000000000000001 R13: dffffc0000000000 R14: ffff88807d748000 R15: 0000000000000100 FS: 0000000000000000(0000) GS:ffff888125c53000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 ---truncado--- Call Trace: btrfs_put_ordered_extent+0x19f/0x470 fs/btrfs/ordered-data.c:635 btrfs_finish_one_ordered+0x11d8/0x1b10 fs/btrfs/inode.c:3312 btrfs_work_helper+0x399/0xc20 fs/btrfs/async-thread.c:312 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Esto puede suceder debido a una ejecuci\u00f3n con el trabajador de recuperaci\u00f3n as\u00edncrono como este: 1) El trabajador de recuperaci\u00f3n de metadatos as\u00edncrono ingresa a shrink_delalloc(), que llama a btrfs_start_delalloc_roots() con un argumento nr_pages que tiene un valor menor que LONG_MAX, y que a su vez ingresa a start_delalloc_inodes(), que establece la variable local 'full_flush' en falso porque wbc->nr_to_write es menor que LONG_MAX; 2) All\u00ed encuentra el inodo X en una lista delalloc de la ra\u00edz, toma una referencia para el inodo X (con igrab()), y activa la escritura diferida para \u00e9l con filemap_fdatawrite_wbc(), que crea una extensi\u00f3n ordenada para el inodo X; 3) La secuencia de desmontaje comienza desde otra tarea, ingresamos close_ctree() y limpiamos la cola de trabajo fs_info->endio_write_workers, que espera a que se complete la extensi\u00f3n ordenada para el inodo X y cuando eliminamos la \u00faltima referencia de la extensi\u00f3n ordenada, con btrfs_put_ordered_extent(), cuando llamamos a btrfs_add_delayed_iput() no agregamos el inodo a la lista de entradas retrasadas porque tiene un refcount de 2, por lo que lo decrementamos a 1 y regresamos; 4) Poco despu\u00e9s, en close_ctree(), llamamos a btrfs_run_delayed_iputs(), que ejecuta todas las entradas retrasadas, y luego establecemos BTRFS_FS_STATE_NO_DELAYED_IPUT en el estado fs_info. 5) El trabajador de recuperaci\u00f3n as\u00edncrono, despu\u00e9s de llamar a filemap_fdatawrite_wbc(), ahora llama a btrfs_add_delayed_iput() para el inodo X y all\u00ed desencadenamos un error de aserci\u00f3n, ya que el estado fs_info tiene el indicador BTRFS_FS_STATE_NO_DELAYED_IPUT establecido. Solucione esto estableciendo BTRFS_FS_STATE_NO_DELAYED_IPUT solo despu\u00e9s de esperar a que finalicen los trabajadores de recuperaci\u00f3n as\u00edncronos, despu\u00e9s de llamar a cancel_work_sync() para ellos en close_ctree(), y ejecutando las entradas retrasadas despu\u00e9s de esperar a que finalicen los trabajadores de recuperaci\u00f3n y antes de establecer el bit. Esta ejecuci\u00f3n se introdujo recientemente mediante el commit 19e60b2a95f5 (\"btrfs: a\u00f1adir una advertencia adicional si se a\u00f1ade una entrada retardada cuando no est\u00e1 permitida\"). Sin la nueva validaci\u00f3n en btrfs_add_delayed_iput(), ---truncado---" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38359.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38359.json index 86e1a9ffcd5..6707451c069 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38359.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38359.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Fix in_atomic() handling in do_secure_storage_access()\n\nKernel user spaces accesses to not exported pages in atomic context\nincorrectly try to resolve the page fault.\nWith debug options enabled call traces like this can be seen:\n\nBUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1523\nin_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 419074, name: qemu-system-s39\npreempt_count: 1, expected: 0\nRCU nest depth: 0, expected: 0\nINFO: lockdep is turned off.\nPreemption disabled at:\n[<00000383ea47cfa2>] copy_page_from_iter_atomic+0xa2/0x8a0\nCPU: 12 UID: 0 PID: 419074 Comm: qemu-system-s39\nTainted: G W 6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug #1 PREEMPT\nTainted: [W]=WARN\nHardware name: IBM 3931 A01 703 (LPAR)\nCall Trace:\n [<00000383e990d282>] dump_stack_lvl+0xa2/0xe8\n [<00000383e99bf152>] __might_resched+0x292/0x2d0\n [<00000383eaa7c374>] down_read+0x34/0x2d0\n [<00000383e99432f8>] do_secure_storage_access+0x108/0x360\n [<00000383eaa724b0>] __do_pgm_check+0x130/0x220\n [<00000383eaa842e4>] pgm_check_handler+0x114/0x160\n [<00000383ea47d028>] copy_page_from_iter_atomic+0x128/0x8a0\n([<00000383ea47d016>] copy_page_from_iter_atomic+0x116/0x8a0)\n [<00000383e9c45eae>] generic_perform_write+0x16e/0x310\n [<00000383e9eb87f4>] ext4_buffered_write_iter+0x84/0x160\n [<00000383e9da0de4>] vfs_write+0x1c4/0x460\n [<00000383e9da123c>] ksys_write+0x7c/0x100\n [<00000383eaa7284e>] __do_syscall+0x15e/0x280\n [<00000383eaa8417e>] system_call+0x6e/0x90\nINFO: lockdep is turned off.\n\nIt is not allowed to take the mmap_lock while in atomic context. Therefore\nhandle such a secure storage access fault as if the accessed page is not\nmapped: the uaccess function will return -EFAULT, and the caller has to\ndeal with this. Usually this means that the access is retried in process\ncontext, which allows to resolve the page fault (or in this case export the\npage)." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: s390/mm: Se corrige la gesti\u00f3n de in_atomic() en do_secure_storage_access(). Los accesos a espacios de usuario del kernel a p\u00e1ginas no exportadas en contexto at\u00f3mico intentan resolver incorrectamente el fallo de p\u00e1gina. Con las opciones de depuraci\u00f3n habilitadas, se pueden observar seguimientos de llamadas como este: BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1523 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 419074, name: qemu-system-s39 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [<00000383ea47cfa2>] copy_page_from_iter_atomic+0xa2/0x8a0 CPU: 12 UID: 0 PID: 419074 Comm: qemu-system-s39 Tainted: G W 6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug #1 PREEMPT Tainted: [W]=WARN Hardware name: IBM 3931 A01 703 (LPAR) Call Trace: [<00000383e990d282>] dump_stack_lvl+0xa2/0xe8 [<00000383e99bf152>] __might_resched+0x292/0x2d0 [<00000383eaa7c374>] down_read+0x34/0x2d0 [<00000383e99432f8>] do_secure_storage_access+0x108/0x360 [<00000383eaa724b0>] __do_pgm_check+0x130/0x220 [<00000383eaa842e4>] pgm_check_handler+0x114/0x160 [<00000383ea47d028>] copy_page_from_iter_atomic+0x128/0x8a0 ([<00000383ea47d016>] copy_page_from_iter_atomic+0x116/0x8a0) [<00000383e9c45eae>] generic_perform_write+0x16e/0x310 [<00000383e9eb87f4>] ext4_buffered_write_iter+0x84/0x160 [<00000383e9da0de4>] vfs_write+0x1c4/0x460 [<00000383e9da123c>] ksys_write+0x7c/0x100 [<00000383eaa7284e>] __do_syscall+0x15e/0x280 [<00000383eaa8417e>] system_call+0x6e/0x90 INFO: lockdep is turned off. No se permite usar mmap_lock en contexto at\u00f3mico. Por lo tanto, se gestiona un fallo de acceso al almacenamiento seguro como si la p\u00e1gina accedida no estuviera mapeada: la funci\u00f3n uaccess devolver\u00e1 -EFAULT, y el usuario que realiza la llamada debe gestionarlo. Normalmente, esto significa que se reintenta el acceso en contexto de proceso, lo que permite resolver el fallo de p\u00e1gina (o, en este caso, exportar la p\u00e1gina)." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38360.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38360.json index 53d07f3f8d8..edd5eb5dabe 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38360.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38360.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add more checks for DSC / HUBP ONO guarantees\n\n[WHY]\nFor non-zero DSC instances it's possible that the HUBP domain required\nto drive it for sequential ONO ASICs isn't met, potentially causing\nthe logic to the tile to enter an undefined state leading to a system\nhang.\n\n[HOW]\nAdd more checks to ensure that the HUBP domain matching the DSC instance\nis appropriately powered.\n\n(cherry picked from commit da63df07112e5a9857a8d2aaa04255c4206754ec)" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: Se han a\u00f1adido m\u00e1s comprobaciones para las garant\u00edas de DSC/HUBP ONO [WHY] En instancias DSC con valores distintos de cero, es posible que no se cumpla el dominio HUBP necesario para controlarlas en ASIC ONO secuenciales, lo que podr\u00eda provocar que la l\u00f3gica del mosaico entre en un estado indefinido y provoque un bloqueo del sistema. [HOW] Se han a\u00f1adido m\u00e1s comprobaciones para garantizar que el dominio HUBP correspondiente a la instancia DSC reciba la alimentaci\u00f3n adecuada. (Seleccionado del commit da63df07112e5a9857a8d2aaa04255c4206754ec)" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38361.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38361.json index 771d7f11095..acaadedb998 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38361.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38361.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check dce_hwseq before dereferencing it\n\n[WHAT]\n\nhws was checked for null earlier in dce110_blank_stream, indicating hws\ncan be null, and should be checked whenever it is used.\n\n(cherry picked from commit 79db43611ff61280b6de58ce1305e0b2ecf675ad)" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: Comprobar dce_hwseq antes de desreferenciarlo [WHAT] hws se verific\u00f3 para nulo anteriormente en dce110_blank_stream, lo que indica que hws puede ser nulo y debe verificarse siempre que se use. (seleccionado del commit 79db43611ff61280b6de58ce1305e0b2ecf675ad)" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38362.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38362.json index f7f5cf7342e..07c68e0423d 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38362.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38362.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null pointer check for get_first_active_display()\n\nThe function mod_hdcp_hdcp1_enable_encryption() calls the function\nget_first_active_display(), but does not check its return value.\nThe return value is a null pointer if the display list is empty.\nThis will lead to a null pointer dereference in\nmod_hdcp_hdcp2_enable_encryption().\n\nAdd a null pointer check for get_first_active_display() and return\nMOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: Se ha a\u00f1adido una comprobaci\u00f3n de puntero nulo para get_first_active_display(). La funci\u00f3n mod_hdcp_hdcp1_enable_encryption() llama a la funci\u00f3n get_first_active_display(), pero no comprueba su valor de retorno. El valor de retorno es un puntero nulo si la lista de visualizaci\u00f3n est\u00e1 vac\u00eda. Esto provocar\u00e1 una desreferencia de puntero nulo en mod_hdcp_hdcp2_enable_encryption(). Se ha a\u00f1adido una comprobaci\u00f3n de puntero nulo para get_first_active_display() y se ha devuelto MOD_HDCP_STATUS_DISPLAY_NOT_FOUND si la funci\u00f3n devuelve un valor nulo." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38363.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38363.json index 1067d6a8c76..c015248cb77 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38363.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38363.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/tegra: Fix a possible null pointer dereference\n\nIn tegra_crtc_reset(), new memory is allocated with kzalloc(), but\nno check is performed. Before calling __drm_atomic_helper_crtc_reset,\nstate should be checked to prevent possible null pointer dereference." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/tegra: Se corrige una posible desreferencia de puntero nulo. En tegra_crtc_reset(), se asigna nueva memoria con kzalloc(), pero no se realiza ninguna comprobaci\u00f3n. Antes de llamar a __drm_atomic_helper_crtc_reset, se debe comprobar el estado para evitar una posible desreferencia de puntero nulo." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38364.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38364.json index f33fc6e5fea..a70748c873a 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38364.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38364.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmaple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()\n\nTemporarily clear the preallocation flag when explicitly requesting\nallocations. Pre-existing allocations are already counted against the\nrequest through mas_node_count_gfp(), but the allocations will not happen\nif the MA_STATE_PREALLOC flag is set. This flag is meant to avoid\nre-allocating in bulk allocation mode, and to detect issues with\npreallocation calculations.\n\nThe MA_STATE_PREALLOC flag should also always be set on zero allocations\nso that detection of underflow allocations will print a WARN_ON() during\nconsumption.\n\nUser visible effect of this flaw is a WARN_ON() followed by a null pointer\ndereference when subsequent requests for larger number of nodes is\nignored, such as the vma merge retry in mmap_region() caused by drivers\naltering the vma flags (which happens in v6.6, at least)" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: maple_tree: correcci\u00f3n del indicador MA_STATE_PREALLOC en mas_preallocate(). Borra temporalmente el indicador de preasignaci\u00f3n al solicitar asignaciones expl\u00edcitamente. Las asignaciones preexistentes ya se contabilizan en la solicitud mediante mas_node_count_gfp(), pero las asignaciones no se realizar\u00e1n si el indicador MA_STATE_PREALLOC est\u00e1 activado. Este indicador evita la reasignaci\u00f3n en modo de asignaci\u00f3n masiva y detecta problemas con los c\u00e1lculos de preasignaci\u00f3n. El indicador MA_STATE_PREALLOC debe estar siempre activado en asignaciones cero para que la detecci\u00f3n de asignaciones por desbordamiento imprima un WARN_ON() durante el consumo. El efecto visible para el usuario de esta falla es un WARN_ON() seguido de una desreferencia de puntero nulo cuando se ignoran solicitudes posteriores de un mayor n\u00famero de nodos, como el reintento de fusi\u00f3n de vma en mmap_region() causado por controladores que alteran los indicadores de vma (al menos en la versi\u00f3n 6.6)." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38365.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38365.json index fe370245a7b..3da663acca7 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38365.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38365.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix a race between renames and directory logging\n\nWe have a race between a rename and directory inode logging that if it\nhappens and we crash/power fail before the rename completes, the next time\nthe filesystem is mounted, the log replay code will end up deleting the\nfile that was being renamed.\n\nThis is best explained following a step by step analysis of an interleaving\nof steps that lead into this situation.\n\nConsider the initial conditions:\n\n1) We are at transaction N;\n\n2) We have directories A and B created in a past transaction (< N);\n\n3) We have inode X corresponding to a file that has 2 hardlinks, one in\n directory A and the other in directory B, so we'll name them as\n \"A/foo_link1\" and \"B/foo_link2\". Both hard links were persisted in a\n past transaction (< N);\n\n4) We have inode Y corresponding to a file that as a single hard link and\n is located in directory A, we'll name it as \"A/bar\". This file was also\n persisted in a past transaction (< N).\n\nThe steps leading to a file loss are the following and for all of them we\nare under transaction N:\n\n 1) Link \"A/foo_link1\" is removed, so inode's X last_unlink_trans field\n is updated to N, through btrfs_unlink() -> btrfs_record_unlink_dir();\n\n 2) Task A starts a rename for inode Y, with the goal of renaming from\n \"A/bar\" to \"A/baz\", so we enter btrfs_rename();\n\n 3) Task A inserts the new BTRFS_INODE_REF_KEY for inode Y by calling\n btrfs_insert_inode_ref();\n\n 4) Because the rename happens in the same directory, we don't set the\n last_unlink_trans field of directoty A's inode to the current\n transaction id, that is, we don't cal btrfs_record_unlink_dir();\n\n 5) Task A then removes the entries from directory A (BTRFS_DIR_ITEM_KEY\n and BTRFS_DIR_INDEX_KEY items) when calling __btrfs_unlink_inode()\n (actually the dir index item is added as a delayed item, but the\n effect is the same);\n\n 6) Now before task A adds the new entry \"A/baz\" to directory A by\n calling btrfs_add_link(), another task, task B is logging inode X;\n\n 7) Task B starts a fsync of inode X and after logging inode X, at\n btrfs_log_inode_parent() it calls btrfs_log_all_parents(), since\n inode X has a last_unlink_trans value of N, set at in step 1;\n\n 8) At btrfs_log_all_parents() we search for all parent directories of\n inode X using the commit root, so we find directories A and B and log\n them. Bu when logging direct A, we don't have a dir index item for\n inode Y anymore, neither the old name \"A/bar\" nor for the new name\n \"A/baz\" since the rename has deleted the old name but has not yet\n inserted the new name - task A hasn't called yet btrfs_add_link() to\n do that.\n\n Note that logging directory A doesn't fallback to a transaction\n commit because its last_unlink_trans has a lower value than the\n current transaction's id (see step 4);\n\n 9) Task B finishes logging directories A and B and gets back to\n btrfs_sync_file() where it calls btrfs_sync_log() to persist the log\n tree;\n\n10) Task B successfully persisted the log tree, btrfs_sync_log() completed\n with success, and a power failure happened.\n\n We have a log tree without any directory entry for inode Y, so the\n log replay code deletes the entry for inode Y, name \"A/bar\", from the\n subvolume tree since it doesn't exist in the log tree and the log\n tree is authorative for its index (we logged a BTRFS_DIR_LOG_INDEX_KEY\n item that covers the index range for the dentry that corresponds to\n \"A/bar\").\n\n Since there's no other hard link for inode Y and the log replay code\n deletes the name \"A/bar\", the file is lost.\n\nThe issue wouldn't happen if task B synced the log only after task A\ncalled btrfs_log_new_name(), which would update the log with the new name\nfor inode Y (\"A/bar\").\n\nFix this by pinning the log root during renames before removing the old\ndirectory entry, and unpinning af\n---truncated---" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: corrige una ejecuci\u00f3n entre los cambios de nombre y el registro de directorios Tenemos una ejecuci\u00f3n entre un cambio de nombre y el registro del inodo del directorio que, si ocurre y nos bloqueamos o falla la energ\u00eda antes de que se complete el cambio de nombre, la pr\u00f3xima vez que se monte el sistema de archivos, el c\u00f3digo de reproducci\u00f3n del registro terminar\u00e1 eliminando el archivo que se estaba cambiando de nombre. Esto se explica mejor siguiendo un an\u00e1lisis paso a paso de un intercalado de pasos que conducen a esta situaci\u00f3n. Considere las condiciones iniciales: 1) Estamos en la transacci\u00f3n N; 2) Tenemos los directorios A y B creados en una transacci\u00f3n anterior (< N); 3) Tenemos el inodo X correspondiente a un archivo que tiene 2 enlaces duros, uno en el directorio A y el otro en el directorio B, por lo que los nombraremos como \"A/foo_link1\" y \"B/foo_link2\". Ambos enlaces duros persistieron en una transacci\u00f3n anterior (< N); 4) Tenemos el inodo Y, correspondiente a un archivo con un \u00fanico enlace f\u00edsico ubicado en el directorio A, al que llamaremos \"A/bar\". Este archivo tambi\u00e9n se conserv\u00f3 en una transacci\u00f3n anterior (< N). Los pasos que conducen a la p\u00e9rdida del archivo son los siguientes, y para todos ellos, estamos en la transacci\u00f3n N: 1) Se elimina el enlace \"A/foo_link1\", por lo que el campo X last_unlink_trans del inodo se actualiza a N mediante btrfs_unlink() -> btrfs_record_unlink_dir(); 2) La tarea A inicia un cambio de nombre para el inodo Y, con el objetivo de cambiar de \"A/bar\" a \"A/baz\", por lo que introducimos btrfs_rename(); 3) La tarea A inserta la nueva clave BTRFS_INODE_REF_KEY para el inodo Y mediante la llamada a btrfs_insert_inode_ref(); 4) Debido a que el cambio de nombre ocurre en el mismo directorio, no establecemos el campo last_unlink_trans del inodo del directorio A en el id de transacci\u00f3n actual, es decir, no llamamos a btrfs_record_unlink_dir(); 5) Luego, la tarea A elimina las entradas del directorio A (elementos BTRFS_DIR_ITEM_KEY y BTRFS_DIR_INDEX_KEY) cuando llama a __btrfs_unlink_inode() (en realidad, el elemento de \u00edndice del directorio se agrega como un elemento retrasado, pero el efecto es el mismo); 6) Ahora, antes de que la tarea A agregue la nueva entrada \"A/baz\" al directorio A llamando a btrfs_add_link(), otra tarea, la tarea B, est\u00e1 registrando el inodo X; 7) La tarea B inicia una sincronizaci\u00f3n fsync del inodo X y, tras registrarlo, en btrfs_log_inode_parent() llama a btrfs_log_all_parents(), ya que el inodo X tiene un valor de last_unlink_trans de N, establecido en el paso 1. 8) En btrfs_log_all_parents() buscamos todos los directorios padre del inodo X utilizando un root commit, por lo que encontramos los directorios A y B y los registramos. Sin embargo, al registrar directamente A, ya no tenemos un elemento de \u00edndice de directorio para el inodo Y, ni para el nombre antiguo \"A/bar\" ni para el nuevo nombre \"A/baz\", ya que el cambio de nombre ha eliminado el nombre antiguo, pero a\u00fan no ha insertado el nuevo. La tarea A a\u00fan no ha llamado a btrfs_add_link() para hacerlo. Tenga en cuenta que registrar el directorio A no recurre a un commit de transacci\u00f3n porque su valor de last_unlink_trans es menor que el ID de la transacci\u00f3n actual (v\u00e9ase el paso 4). 9) La tarea B finaliza el registro de los directorios A y B y regresa a btrfs_sync_file(), donde invoca btrfs_sync_log() para persistir el \u00e1rbol de registro. 10) La tarea B persisti\u00f3 correctamente el \u00e1rbol de registro, btrfs_sync_log() se complet\u00f3 correctamente y se produjo un corte de energ\u00eda. Tenemos un \u00e1rbol de registro sin ninguna entrada de directorio para el inodo Y, por lo que el c\u00f3digo de reproducci\u00f3n del registro elimina la entrada del inodo Y, llamada \"A/bar\", del \u00e1rbol de subvolumen, ya que no existe en el \u00e1rbol de registro y este es autoritario para su \u00edndice (registramos un elemento BTRFS_DIR_LOG_INDEX_KEY que cubre el rango de \u00edndices de la entrada dentry correspondiente a \"A/bar\"). ---truncado---" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38366.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38366.json index 143cbca8b7d..d6088008e6b 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38366.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38366.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Check validity of \"num_cpu\" from user space\n\nThe maximum supported cpu number is EIOINTC_ROUTE_MAX_VCPUS about\nirqchip EIOINTC, here add validation about cpu number to avoid array\npointer overflow." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: LoongArch: KVM: verificar la validez de \"num_cpu\" desde el espacio del usuario. El n\u00famero m\u00e1ximo de CPU admitido es EIOINTC_ROUTE_MAX_VCPUS sobre irqchip EIOINTC, aqu\u00ed agregue validaci\u00f3n sobre el n\u00famero de CPU para evitar el desbordamiento del puntero de la matriz." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38367.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38367.json index 58ce8b42b8e..67f3d70d5ae 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38367.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38367.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Avoid overflow with array index\n\nThe variable index is modified and reused as array index when modify\nregister EIOINTC_ENABLE. There will be array index overflow problem." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: LoongArch: KVM: Evitar el desbordamiento con el \u00edndice de la matriz. La variable \u00edndice se modifica y se reutiliza como \u00edndice de la matriz al modificar el registro EIOINTC_ENABLE. Se producir\u00e1 un problema de desbordamiento del \u00edndice de la matriz." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38368.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38368.json index d6eed427df8..db226237873 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38368.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38368.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe()\n\nThe returned value, pfsm->miscdev.name, from devm_kasprintf()\ncould be NULL.\nA pointer check is added to prevent potential NULL pointer dereference.\nThis is similar to the fix in commit 3027e7b15b02\n(\"ice: Fix some null pointer dereference issues in ice_ptp.c\").\n\nThis issue is found by our static analysis tool." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: misc: tps6594-pfsm: Se ha a\u00f1adido una comprobaci\u00f3n de puntero nulo en tps6594_pfsm_probe(). El valor devuelto, pfsm->miscdev.name, desde devm_kasprintf() podr\u00eda ser nulo. Se ha a\u00f1adido una comprobaci\u00f3n de puntero para evitar posibles desreferencias de punteros nulos. Esto es similar a la correcci\u00f3n en el commit 3027e7b15b02 (\"ice: Se corrigen algunos problemas de desreferencia de puntero nulo en ice_ptp.c\"). Nuestra herramienta de an\u00e1lisis est\u00e1tico ha detectado este problema." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38369.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38369.json index 75c88b2d648..a8150ff8c73 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38369.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38369.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using\n\nRunning IDXD workloads in a container with the /dev directory mounted can\ntrigger a call trace or even a kernel panic when the parent process of the\ncontainer is terminated.\n\nThis issue occurs because, under certain configurations, Docker does not\nproperly propagate the mount replica back to the original mount point.\n\nIn this case, when the user driver detaches, the WQ is destroyed but it\nstill calls destroy_workqueue() attempting to completes all pending work.\nIt's necessary to check wq->wq and skip the drain if it no longer exists." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dmaengine: idxd: Comprobar la disponibilidad de la cola de trabajo asignada por el controlador wq de idxd antes de usarla. Ejecutar cargas de trabajo IDXD en un contenedor con el directorio /dev montado puede provocar un seguimiento de llamadas o incluso un p\u00e1nico del kernel cuando finaliza el proceso principal del contenedor. Este problema se produce porque, en ciertas configuraciones, Docker no propaga correctamente la r\u00e9plica de montaje al punto de montaje original. En este caso, al desconectarse el controlador de usuario, la cola de trabajo se destruye, pero sigue llamando a destroy_workqueue() para intentar completar todo el trabajo pendiente. Es necesario comprobar wq->wq y omitir el vaciado si ya no existe." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38370.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38370.json index 4b69013a92e..425bd4edbd4 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38370.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38370.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix failure to rebuild free space tree using multiple transactions\n\nIf we are rebuilding a free space tree, while modifying the free space\ntree we may need to allocate a new metadata block group.\nIf we end up using multiple transactions for the rebuild, when we call\nbtrfs_end_transaction() we enter btrfs_create_pending_block_groups()\nwhich calls add_block_group_free_space() to add items to the free space\ntree for the block group.\n\nThen later during the free space tree rebuild, at\nbtrfs_rebuild_free_space_tree(), we may find such new block groups\nand call populate_free_space_tree() for them, which fails with -EEXIST\nbecause there are already items in the free space tree. Then we abort the\ntransaction with -EEXIST at btrfs_rebuild_free_space_tree().\nNotice that we say \"may find\" the new block groups because a new block\ngroup may be inserted in the block groups rbtree, which is being iterated\nby the rebuild process, before or after the current node where the rebuild\nprocess is currently at.\n\nSyzbot recently reported such case which produces a trace like the\nfollowing:\n\n ------------[ cut here ]------------\n BTRFS: Transaction aborted (error -17)\n WARNING: CPU: 1 PID: 7626 at fs/btrfs/free-space-tree.c:1341 btrfs_rebuild_free_space_tree+0x470/0x54c fs/btrfs/free-space-tree.c:1341\n Modules linked in:\n CPU: 1 UID: 0 PID: 7626 Comm: syz.2.25 Not tainted 6.15.0-rc7-syzkaller-00085-gd7fa1af5b33e-dirty #0 PREEMPT\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\n pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : btrfs_rebuild_free_space_tree+0x470/0x54c fs/btrfs/free-space-tree.c:1341\n lr : btrfs_rebuild_free_space_tree+0x470/0x54c fs/btrfs/free-space-tree.c:1341\n sp : ffff80009c4f7740\n x29: ffff80009c4f77b0 x28: ffff0000d4c3f400 x27: 0000000000000000\n x26: dfff800000000000 x25: ffff70001389eee8 x24: 0000000000000003\n x23: 1fffe000182b6e7b x22: 0000000000000000 x21: ffff0000c15b73d8\n x20: 00000000ffffffef x19: ffff0000c15b7378 x18: 1fffe0003386f276\n x17: ffff80008f31e000 x16: ffff80008adbe98c x15: 0000000000000001\n x14: 1fffe0001b281550 x13: 0000000000000000 x12: 0000000000000000\n x11: ffff60001b281551 x10: 0000000000000003 x9 : 1c8922000a902c00\n x8 : 1c8922000a902c00 x7 : ffff800080485878 x6 : 0000000000000000\n x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008047843c\n x2 : 0000000000000001 x1 : ffff80008b3ebc40 x0 : 0000000000000001\n Call trace:\n btrfs_rebuild_free_space_tree+0x470/0x54c fs/btrfs/free-space-tree.c:1341 (P)\n btrfs_start_pre_rw_mount+0xa78/0xe10 fs/btrfs/disk-io.c:3074\n btrfs_remount_rw fs/btrfs/super.c:1319 [inline]\n btrfs_reconfigure+0x828/0x2418 fs/btrfs/super.c:1543\n reconfigure_super+0x1d4/0x6f0 fs/super.c:1083\n do_remount fs/namespace.c:3365 [inline]\n path_mount+0xb34/0xde0 fs/namespace.c:4200\n do_mount fs/namespace.c:4221 [inline]\n __do_sys_mount fs/namespace.c:4432 [inline]\n __se_sys_mount fs/namespace.c:4409 [inline]\n __arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4409\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151\n el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767\n el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786\n el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600\n irq event stamp: 330\n hardirqs last enabled at (329): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1525 [inline]\n hardirqs last enabled at (329): [] finish_lock_switch+0xb0/0x1c0 kernel/sched/core.c:5130\n hardirqs last disabled at (330): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:511\n softirqs last enabled at (10): [] local_bh_enable+0\n---truncated---" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: se corrige el error al reconstruir el \u00e1rbol de espacio libre utilizando m\u00faltiples transacciones Si estamos reconstruyendo un \u00e1rbol de espacio libre, mientras modificamos el \u00e1rbol de espacio libre, es posible que necesitemos asignar un nuevo grupo de bloques de metadatos. Si terminamos utilizando m\u00faltiples transacciones para la reconstrucci\u00f3n, cuando llamamos a btrfs_end_transaction() ingresamos btrfs_create_pending_block_groups() que llama a add_block_group_free_space() para agregar elementos al \u00e1rbol de espacio libre para el grupo de bloques. Luego, m\u00e1s tarde durante la reconstrucci\u00f3n del \u00e1rbol de espacio libre, en btrfs_rebuild_free_space_tree(), podemos encontrar dichos nuevos grupos de bloques y llamar a populate_free_space_tree() para ellos, lo que falla con -EEXIST porque ya hay elementos en el \u00e1rbol de espacio libre. Luego abortamos la transacci\u00f3n con -EEXIST en btrfs_rebuild_free_space_tree(). Tenga en cuenta que decimos \"puede encontrar\" los nuevos grupos de bloques porque se puede insertar un nuevo grupo de bloques en el \u00e1rbol de grupos de bloques, que est\u00e1 siendo iterado por el proceso de reconstrucci\u00f3n, antes o despu\u00e9s del nodo actual en el que se encuentra actualmente el proceso de reconstrucci\u00f3n. Syzbot inform\u00f3 recientemente de un caso similar que produce un seguimiento como el siguiente: ------------[ cut here ]------------ BTRFS: Transaction aborted (error -17) WARNING: CPU: 1 PID: 7626 at fs/btrfs/free-space-tree.c:1341 btrfs_rebuild_free_space_tree+0x470/0x54c fs/btrfs/free-space-tree.c:1341 Modules linked in: CPU: 1 UID: 0 PID: 7626 Comm: syz.2.25 Not tainted 6.15.0-rc7-syzkaller-00085-gd7fa1af5b33e-dirty #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : btrfs_rebuild_free_space_tree+0x470/0x54c fs/btrfs/free-space-tree.c:1341 lr : btrfs_rebuild_free_space_tree+0x470/0x54c fs/btrfs/free-space-tree.c:1341 sp : ffff80009c4f7740 x29: ffff80009c4f77b0 x28: ffff0000d4c3f400 x27: 0000000000000000 x26: dfff800000000000 x25: ffff70001389eee8 x24: 0000000000000003 x23: 1fffe000182b6e7b x22: 0000000000000000 x21: ffff0000c15b73d8 x20: 00000000ffffffef x19: ffff0000c15b7378 x18: 1fffe0003386f276 x17: ffff80008f31e000 x16: ffff80008adbe98c x15: 0000000000000001 x14: 1fffe0001b281550 x13: 0000000000000000 x12: 0000000000000000 x11: ffff60001b281551 x10: 0000000000000003 x9 : 1c8922000a902c00 x8 : 1c8922000a902c00 x7 : ffff800080485878 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008047843c x2 : 0000000000000001 x1 : ffff80008b3ebc40 x0 : 0000000000000001 Call trace: btrfs_rebuild_free_space_tree+0x470/0x54c fs/btrfs/free-space-tree.c:1341 (P) btrfs_start_pre_rw_mount+0xa78/0xe10 fs/btrfs/disk-io.c:3074 btrfs_remount_rw fs/btrfs/super.c:1319 [inline] btrfs_reconfigure+0x828/0x2418 fs/btrfs/super.c:1543 reconfigure_super+0x1d4/0x6f0 fs/super.c:1083 do_remount fs/namespace.c:3365 [inline] path_mount+0xb34/0xde0 fs/namespace.c:4200 do_mount fs/namespace.c:4221 [inline] __do_sys_mount fs/namespace.c:4432 [inline] __se_sys_mount fs/namespace.c:4409 [inline] __arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4409 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 irq event stamp: 330 hardirqs last enabled at (329): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1525 [inline] hardirqs last enabled at (329): [] finish_lock_switch+0xb0/0x1c0 kernel/sched/core.c:5130 hardirqs last disabled at (330): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:511 ---truncado---" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38371.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38371.json index ba23711f553..98518179a86 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38371.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38371.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Disable interrupts before resetting the GPU\n\nCurrently, an interrupt can be triggered during a GPU reset, which can\nlead to GPU hangs and NULL pointer dereference in an interrupt context\nas shown in the following trace:\n\n [ 314.035040] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0\n [ 314.043822] Mem abort info:\n [ 314.046606] ESR = 0x0000000096000005\n [ 314.050347] EC = 0x25: DABT (current EL), IL = 32 bits\n [ 314.055651] SET = 0, FnV = 0\n [ 314.058695] EA = 0, S1PTW = 0\n [ 314.061826] FSC = 0x05: level 1 translation fault\n [ 314.066694] Data abort info:\n [ 314.069564] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n [ 314.075039] CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n [ 314.080080] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n [ 314.085382] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000102728000\n [ 314.091814] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\n [ 314.100511] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP\n [ 314.106770] Modules linked in: v3d i2c_brcmstb vc4 snd_soc_hdmi_codec gpu_sched drm_shmem_helper drm_display_helper cec drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight\n [ 314.129654] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1\n [ 314.139388] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)\n [ 314.145211] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n [ 314.152165] pc : v3d_irq+0xec/0x2e0 [v3d]\n [ 314.156187] lr : v3d_irq+0xe0/0x2e0 [v3d]\n [ 314.160198] sp : ffffffc080003ea0\n [ 314.163502] x29: ffffffc080003ea0 x28: ffffffec1f184980 x27: 021202b000000000\n [ 314.170633] x26: ffffffec1f17f630 x25: ffffff8101372000 x24: ffffffec1f17d9f0\n [ 314.177764] x23: 000000000000002a x22: 000000000000002a x21: ffffff8103252000\n [ 314.184895] x20: 0000000000000001 x19: 00000000deadbeef x18: 0000000000000000\n [ 314.192026] x17: ffffff94e51d2000 x16: ffffffec1dac3cb0 x15: c306000000000000\n [ 314.199156] x14: 0000000000000000 x13: b2fc982e03cc5168 x12: 0000000000000001\n [ 314.206286] x11: ffffff8103f8bcc0 x10: ffffffec1f196868 x9 : ffffffec1dac3874\n [ 314.213416] x8 : 0000000000000000 x7 : 0000000000042a3a x6 : ffffff810017a180\n [ 314.220547] x5 : ffffffec1ebad400 x4 : ffffffec1ebad320 x3 : 00000000000bebeb\n [ 314.227677] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000\n [ 314.234807] Call trace:\n [ 314.237243] v3d_irq+0xec/0x2e0 [v3d]\n [ 314.240906] __handle_irq_event_percpu+0x58/0x218\n [ 314.245609] handle_irq_event+0x54/0xb8\n [ 314.249439] handle_fasteoi_irq+0xac/0x240\n [ 314.253527] handle_irq_desc+0x48/0x68\n [ 314.257269] generic_handle_domain_irq+0x24/0x38\n [ 314.261879] gic_handle_irq+0x48/0xd8\n [ 314.265533] call_on_irq_stack+0x24/0x58\n [ 314.269448] do_interrupt_handler+0x88/0x98\n [ 314.273624] el1_interrupt+0x34/0x68\n [ 314.277193] el1h_64_irq_handler+0x18/0x28\n [ 314.281281] el1h_64_irq+0x64/0x68\n [ 314.284673] default_idle_call+0x3c/0x168\n [ 314.288675] do_idle+0x1fc/0x230\n [ 314.291895] cpu_startup_entry+0x3c/0x50\n [ 314.295810] rest_init+0xe4/0xf0\n [ 314.299030] start_kernel+0x5e8/0x790\n [ 314.302684] __primary_switched+0x80/0x90\n [ 314.306691] Code: 940029eb 360ffc13 f9442ea0 52800001 (f9406017)\n [ 314.312775] ---[ end trace 0000000000000000 ]---\n [ 314.317384] Kernel panic - not syncing: Oops: Fatal exception in interrupt\n [ 314.324249] SMP: stopping secondary CPUs\n [ 314.328167] Kernel Offset: 0x2b9da00000 from 0xffffffc080000000\n [ 314.334076] PHYS_OFFSET: 0x0\n [ 314.336946] CPU features: 0x08,00002013,c0200000,0200421b\n [ 314.342337] Memory Limit: none\n [ 314.345382] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---\n\nBefore resetting the G\n---truncated---" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/v3d: Deshabilitar interrupciones antes de reiniciar la GPU Actualmente, se puede activar una interrupci\u00f3n durante un reinicio de la GPU, lo que puede provocar bloqueos de la GPU y desreferenciaci\u00f3n del puntero NULL en un contexto de interrupci\u00f3n como se muestra en el siguiente seguimiento: [ 314.035040] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0 [ 314.043822] Mem abort info: [ 314.046606] ESR = 0x0000000096000005 [ 314.050347] EC = 0x25: DABT (current EL), IL = 32 bits [ 314.055651] SET = 0, FnV = 0 [ 314.058695] EA = 0, S1PTW = 0 [ 314.061826] FSC = 0x05: level 1 translation fault [ 314.066694] Data abort info: [ 314.069564] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 314.075039] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 314.080080] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 314.085382] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000102728000 [ 314.091814] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 314.100511] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 314.106770] Modules linked in: v3d i2c_brcmstb vc4 snd_soc_hdmi_codec gpu_sched drm_shmem_helper drm_display_helper cec drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm snd_timer snd backlight [ 314.129654] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1 Debian 1:6.12.25-1+rpt1 [ 314.139388] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT) [ 314.145211] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 314.152165] pc : v3d_irq+0xec/0x2e0 [v3d] [ 314.156187] lr : v3d_irq+0xe0/0x2e0 [v3d] [ 314.160198] sp : ffffffc080003ea0 [ 314.163502] x29: ffffffc080003ea0 x28: ffffffec1f184980 x27: 021202b000000000 [ 314.170633] x26: ffffffec1f17f630 x25: ffffff8101372000 x24: ffffffec1f17d9f0 [ 314.177764] x23: 000000000000002a x22: 000000000000002a x21: ffffff8103252000 [ 314.184895] x20: 0000000000000001 x19: 00000000deadbeef x18: 0000000000000000 [ 314.192026] x17: ffffff94e51d2000 x16: ffffffec1dac3cb0 x15: c306000000000000 [ 314.199156] x14: 0000000000000000 x13: b2fc982e03cc5168 x12: 0000000000000001 [ 314.206286] x11: ffffff8103f8bcc0 x10: ffffffec1f196868 x9 : ffffffec1dac3874 [ 314.213416] x8 : 0000000000000000 x7 : 0000000000042a3a x6 : ffffff810017a180 [ 314.220547] x5 : ffffffec1ebad400 x4 : ffffffec1ebad320 x3 : 00000000000bebeb [ 314.227677] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 [ 314.234807] Call trace: [ 314.237243] v3d_irq+0xec/0x2e0 [v3d] [ 314.240906] __handle_irq_event_percpu+0x58/0x218 [ 314.245609] handle_irq_event+0x54/0xb8 [ 314.249439] handle_fasteoi_irq+0xac/0x240 [ 314.253527] handle_irq_desc+0x48/0x68 [ 314.257269] generic_handle_domain_irq+0x24/0x38 [ 314.261879] gic_handle_irq+0x48/0xd8 [ 314.265533] call_on_irq_stack+0x24/0x58 [ 314.269448] do_interrupt_handler+0x88/0x98 [ 314.273624] el1_interrupt+0x34/0x68 [ 314.277193] el1h_64_irq_handler+0x18/0x28 [ 314.281281] el1h_64_irq+0x64/0x68 [ 314.284673] default_idle_call+0x3c/0x168 [ 314.288675] do_idle+0x1fc/0x230 [ 314.291895] cpu_startup_entry+0x3c/0x50 [ 314.295810] rest_init+0xe4/0xf0 [ 314.299030] start_kernel+0x5e8/0x790 [ 314.302684] __primary_switched+0x80/0x90 [ 314.306691] Code: 940029eb 360ffc13 f9442ea0 52800001 (f9406017) [ 314.312775] ---[ end trace 0000000000000000 ]--- [ 314.317384] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 314.324249] SMP: stopping secondary CPUs [ 314.328167] Kernel Offset: 0x2b9da00000 from 0xffffffc080000000 [ 314.334076] PHYS_OFFSET: 0x0 [ 314.336946] CPU features: 0x08,00002013,c0200000,0200421b [ 314.342337] Memory Limit: none [ 314.345382] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- Before resetting the G ---truncado---" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38372.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38372.json index a192db33a5f..739d3ad7dd2 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38372.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38372.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix unsafe xarray access in implicit ODP handling\n\n__xa_store() and __xa_erase() were used without holding the proper lock,\nwhich led to a lockdep warning due to unsafe RCU usage. This patch\nreplaces them with xa_store() and xa_erase(), which perform the necessary\nlocking internally.\n\n =============================\n WARNING: suspicious RCPU usage\n 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted\n -----------------------------\n ./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage!\n\n other info that might help us debug this:\n\n rcu_scheduler_active = 2, debug_locks = 1\n 3 locks held by kworker/u136:0/219:\n at: process_one_work+0xbe4/0x15f0\n process_one_work+0x75c/0x15f0\n pagefault_mr+0x9a5/0x1390 [mlx5_ib]\n\n stack backtrace:\n CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted\n 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib]\n Call Trace:\n dump_stack_lvl+0xa8/0xc0\n lockdep_rcu_suspicious+0x1e6/0x260\n xas_create+0xb8a/0xee0\n xas_store+0x73/0x14c0\n __xa_store+0x13c/0x220\n ? xa_store_range+0x390/0x390\n ? spin_bug+0x1d0/0x1d0\n pagefault_mr+0xcb5/0x1390 [mlx5_ib]\n ? _raw_spin_unlock+0x1f/0x30\n mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib]\n ? lockdep_hardirqs_on_prepare+0x400/0x400\n ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib]\n process_one_work+0x7db/0x15f0\n ? pwq_dec_nr_in_flight+0xda0/0xda0\n ? assign_work+0x168/0x240\n worker_thread+0x57d/0xcd0\n ? rescuer_thread+0xc40/0xc40\n kthread+0x3b3/0x800\n ? kthread_is_per_cpu+0xb0/0xb0\n ? lock_downgrade+0x680/0x680\n ? do_raw_spin_lock+0x12d/0x270\n ? spin_bug+0x1d0/0x1d0\n ? finish_task_switch.isra.0+0x284/0x9e0\n ? lockdep_hardirqs_on_prepare+0x284/0x400\n ? kthread_is_per_cpu+0xb0/0xb0\n ret_from_fork+0x2d/0x70\n ? kthread_is_per_cpu+0xb0/0xb0\n ret_from_fork_asm+0x11/0x20" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/mlx5: Se corrige el acceso inseguro a la matriz x en la gesti\u00f3n impl\u00edcita de ODP. __xa_store() y __xa_erase() se usaban sin mantener el bloqueo adecuado, lo que generaba una advertencia de bloqueo debido al uso inseguro de RCU. Este parche los reemplaza con xa_store() y xa_erase(), que realizan el bloqueo necesario internamente. ============================= WARNING: suspicious RCPU usage 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted ----------------------------- ./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 3 locks held by kworker/u136:0/219: at: process_one_work+0xbe4/0x15f0 process_one_work+0x75c/0x15f0 pagefault_mr+0x9a5/0x1390 [mlx5_ib] stack backtrace: CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted 6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] Call Trace: dump_stack_lvl+0xa8/0xc0 lockdep_rcu_suspicious+0x1e6/0x260 xas_create+0xb8a/0xee0 xas_store+0x73/0x14c0 __xa_store+0x13c/0x220 ? xa_store_range+0x390/0x390 ? spin_bug+0x1d0/0x1d0 pagefault_mr+0xcb5/0x1390 [mlx5_ib] ? _raw_spin_unlock+0x1f/0x30 mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib] ? lockdep_hardirqs_on_prepare+0x400/0x400 ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib] process_one_work+0x7db/0x15f0 ? pwq_dec_nr_in_flight+0xda0/0xda0 ? assign_work+0x168/0x240 worker_thread+0x57d/0xcd0 ? rescuer_thread+0xc40/0xc40 kthread+0x3b3/0x800 ? kthread_is_per_cpu+0xb0/0xb0 ? lock_downgrade+0x680/0x680 ? do_raw_spin_lock+0x12d/0x270 ? spin_bug+0x1d0/0x1d0 ? finish_task_switch.isra.0+0x284/0x9e0 ? lockdep_hardirqs_on_prepare+0x284/0x400 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork+0x2d/0x70 ? kthread_is_per_cpu+0xb0/0xb0 ret_from_fork_asm+0x11/0x20" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38373.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38373.json index ab42d797353..5698857ca6c 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38373.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38373.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx5: Fix potential deadlock in MR deregistration\n\nThe issue arises when kzalloc() is invoked while holding umem_mutex or\nany other lock acquired under umem_mutex. This is problematic because\nkzalloc() can trigger fs_reclaim_aqcuire(), which may, in turn, invoke\nmmu_notifier_invalidate_range_start(). This function can lead to\nmlx5_ib_invalidate_range(), which attempts to acquire umem_mutex again,\nresulting in a deadlock.\n\nThe problematic flow:\n CPU0 | CPU1\n---------------------------------------|------------------------------------------------\nmlx5_ib_dereg_mr() |\n \u2192 revoke_mr() |\n \u2192 mutex_lock(&umem_odp->umem_mutex) |\n | mlx5_mkey_cache_init()\n | \u2192 mutex_lock(&dev->cache.rb_lock)\n | \u2192 mlx5r_cache_create_ent_locked()\n | \u2192 kzalloc(GFP_KERNEL)\n | \u2192 fs_reclaim()\n | \u2192 mmu_notifier_invalidate_range_start()\n | \u2192 mlx5_ib_invalidate_range()\n | \u2192 mutex_lock(&umem_odp->umem_mutex)\n \u2192 cache_ent_find_and_store() |\n \u2192 mutex_lock(&dev->cache.rb_lock) |\n\nAdditionally, when kzalloc() is called from within\ncache_ent_find_and_store(), we encounter the same deadlock due to\nre-acquisition of umem_mutex.\n\nSolve by releasing umem_mutex in dereg_mr() after umr_revoke_mr()\nand before acquiring rb_lock. This ensures that we don't hold\numem_mutex while performing memory allocations that could trigger\nthe reclaim path.\n\nThis change prevents the deadlock by ensuring proper lock ordering and\navoiding holding locks during memory allocation operations that could\ntrigger the reclaim path.\n\nThe following lockdep warning demonstrates the deadlock:\n\n python3/20557 is trying to acquire lock:\n ffff888387542128 (&umem_odp->umem_mutex){+.+.}-{4:4}, at:\n mlx5_ib_invalidate_range+0x5b/0x550 [mlx5_ib]\n\n but task is already holding lock:\n ffffffff82f6b840 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at:\n unmap_vmas+0x7b/0x1a0\n\n which lock already depends on the new lock.\n\n the existing dependency chain (in reverse order) is:\n\n -> #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:\n fs_reclaim_acquire+0x60/0xd0\n mem_cgroup_css_alloc+0x6f/0x9b0\n cgroup_init_subsys+0xa4/0x240\n cgroup_init+0x1c8/0x510\n start_kernel+0x747/0x760\n x86_64_start_reservations+0x25/0x30\n x86_64_start_kernel+0x73/0x80\n common_startup_64+0x129/0x138\n\n -> #2 (fs_reclaim){+.+.}-{0:0}:\n fs_reclaim_acquire+0x91/0xd0\n __kmalloc_cache_noprof+0x4d/0x4c0\n mlx5r_cache_create_ent_locked+0x75/0x620 [mlx5_ib]\n mlx5_mkey_cache_init+0x186/0x360 [mlx5_ib]\n mlx5_ib_stage_post_ib_reg_umr_init+0x3c/0x60 [mlx5_ib]\n __mlx5_ib_add+0x4b/0x190 [mlx5_ib]\n mlx5r_probe+0xd9/0x320 [mlx5_ib]\n auxiliary_bus_probe+0x42/0x70\n really_probe+0xdb/0x360\n __driver_probe_device+0x8f/0x130\n driver_probe_device+0x1f/0xb0\n __driver_attach+0xd4/0x1f0\n bus_for_each_dev+0x79/0xd0\n bus_add_driver+0xf0/0x200\n driver_register+0x6e/0xc0\n __auxiliary_driver_register+0x6a/0xc0\n do_one_initcall+0x5e/0x390\n do_init_module+0x88/0x240\n init_module_from_file+0x85/0xc0\n idempotent_init_module+0x104/0x300\n __x64_sys_finit_module+0x68/0xc0\n do_syscall_64+0x6d/0x140\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n -> #1 (&dev->cache.rb_lock){+.+.}-{4:4}:\n __mutex_lock+0x98/0xf10\n __mlx5_ib_dereg_mr+0x6f2/0x890 [mlx5_ib]\n mlx5_ib_dereg_mr+0x21/0x110 [mlx5_ib]\n ib_dereg_mr_user+0x85/0x1f0 [ib_core]\n \n---truncated---" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: IB/mlx5: Arreglar un posible bloqueo en la anulaci\u00f3n del registro de MR El problema surge cuando se invoca kzalloc() mientras se mantiene umem_mutex o cualquier otro bloqueo adquirido bajo umem_mutex. Esto es problem\u00e1tico porque kzalloc() puede activar fs_reclaim_aqcuire(), que puede, a su vez, invocar mmu_notifier_invalidate_range_start(). Esta funci\u00f3n puede llevar a mlx5_ib_invalidate_range(), que intenta adquirir umem_mutex de nuevo, lo que resulta en un bloqueo. El flujo problem\u00e1tico: CPU0 | CPU1 ---------------------------------------|------------------------------------------------ mlx5_ib_dereg_mr() | ? revoke_mr() | ? mutex_lock(&umem_odp->umem_mutex) | | mlx5_mkey_cache_init() | ? mutex_lock(&dev->cache.rb_lock) | ? mlx5r_cache_create_ent_locked() | ? kzalloc(GFP_KERNEL) | ? fs_reclaim() | ? mmu_notifier_invalidate_range_start() | ? mlx5_ib_invalidate_range() | ? mutex_lock(&umem_odp->umem_mutex) ? cache_ent_find_and_store() | ? mutex_lock(&dev->cache.rb_lock) | Adem\u00e1s, cuando se llama a kzalloc() desde dentro de cache_ent_find_and_store(), encontramos el mismo bloqueo debido a la readquisici\u00f3n de umem_mutex. Se resuelve liberando umem_mutex en dereg_mr() despu\u00e9s de umr_revoke_mr() y antes de adquirir rb_lock. Esto garantiza que no se mantenga umem_mutex mientras se realizan asignaciones de memoria que podr\u00edan activar la ruta de recuperaci\u00f3n. Este cambio previene el interbloqueo al asegurar el orden correcto de los bloqueos y evitar mantenerlos durante las operaciones de asignaci\u00f3n de memoria que podr\u00edan activar la ruta de recuperaci\u00f3n. La siguiente advertencia de lockdep demuestra el bloqueo: ython3/20557 is trying to acquire lock: ffff888387542128 (&umem_odp->umem_mutex){+.+.}-{4:4}, at: mlx5_ib_invalidate_range+0x5b/0x550 [mlx5_ib] but task is already holding lock: ffffffff82f6b840 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: unmap_vmas+0x7b/0x1a0 cuyo bloqueo ya depende del nuevo bloqueo. la cadena de dependencia existente (en orden inverso) es:-> #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}: fs_reclaim_acquire+0x60/0xd0 mem_cgroup_css_alloc+0x6f/0x9b0 cgroup_init_subsys+0xa4/0x240 cgroup_init+0x1c8/0x510 start_kernel+0x747/0x760 x86_64_start_reservations+0x25/0x30 x86_64_start_kernel+0x73/0x80 common_startup_64+0x129/0x138 -> #2 (fs_reclaim){+.+.}-{0:0}: fs_reclaim_acquire+0x91/0xd0 __kmalloc_cache_noprof+0x4d/0x4c0 mlx5r_cache_create_ent_locked+0x75/0x620 [mlx5_ib] mlx5_mkey_cache_init+0x186/0x360 [mlx5_ib] mlx5_ib_stage_post_ib_reg_umr_init+0x3c/0x60 [mlx5_ib] __mlx5_ib_add+0x4b/0x190 [mlx5_ib] mlx5r_probe+0xd9/0x320 [mlx5_ib] auxiliary_bus_probe+0x42/0x70 really_probe+0xdb/0x360 __driver_probe_device+0x8f/0x130 driver_probe_device+0x1f/0xb0 __driver_attach+0xd4/0x1f0 bus_for_each_dev+0x79/0xd0 bus_add_driver+0xf0/0x200 driver_register+0x6e/0xc0 __auxiliary_driver_register+0x6a/0xc0 do_one_initcall+0x5e/0x390 do_init_module+0x88/0x240 init_module_from_file+0x85/0xc0 idempotent_init_module+0x104/0x300 __x64_sys_finit_module+0x68/0xc0 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x4b/0x53 -> #1 (&dev->cache.rb_lock){+.+.}-{4:4}: __mutex_lock+0x98/0xf10 __mlx5_ib_dereg_mr+0x6f2/0x890 [mlx5_ib] mlx5_ib_dereg_mr+0x21/0x110 [mlx5_ib] ib_dereg_mr_user+0x85/0x1f0 [ib_core] ---truncated---" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38374.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38374.json index b4071edbff8..4791aa81c58 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38374.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38374.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\noptee: ffa: fix sleep in atomic context\n\nThe OP-TEE driver registers the function notif_callback() for FF-A\nnotifications. However, this function is called in an atomic context\nleading to errors like this when processing asynchronous notifications:\n\n | BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258\n | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0\n | preempt_count: 1, expected: 0\n | RCU nest depth: 0, expected: 0\n | CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0-00019-g657536ebe0aa #13\n | Hardware name: linux,dummy-virt (DT)\n | Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn\n | Call trace:\n | show_stack+0x18/0x24 (C)\n | dump_stack_lvl+0x78/0x90\n | dump_stack+0x18/0x24\n | __might_resched+0x114/0x170\n | __might_sleep+0x48/0x98\n | mutex_lock+0x24/0x80\n | optee_get_msg_arg+0x7c/0x21c\n | simple_call_with_arg+0x50/0xc0\n | optee_do_bottom_half+0x14/0x20\n | notif_callback+0x3c/0x48\n | handle_notif_callbacks+0x9c/0xe0\n | notif_get_and_handle+0x40/0x88\n | generic_exec_single+0x80/0xc0\n | smp_call_function_single+0xfc/0x1a0\n | notif_pcpu_irq_work_fn+0x2c/0x38\n | process_one_work+0x14c/0x2b4\n | worker_thread+0x2e4/0x3e0\n | kthread+0x13c/0x210\n | ret_from_fork+0x10/0x20\n\nFix this by adding work queue to process the notification in a\nnon-atomic context." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: optee: ffa: correcci\u00f3n de suspensi\u00f3n en contexto at\u00f3mico. El controlador OP-TEE registra la funci\u00f3n notif_callback() para las notificaciones FF-A. Sin embargo, esta funci\u00f3n se llama en un contexto at\u00f3mico, lo que genera errores como este al procesar notificaciones as\u00edncronas: | BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258 | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0 | preempt_count: 1, expected: 0 | RCU nest depth: 0, expected: 0 | CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0-00019-g657536ebe0aa #13 | Hardware name: linux,dummy-virt (DT) | Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn | Call trace: | show_stack+0x18/0x24 (C) | dump_stack_lvl+0x78/0x90 | dump_stack+0x18/0x24 | __might_resched+0x114/0x170 | __might_sleep+0x48/0x98 | mutex_lock+0x24/0x80 | optee_get_msg_arg+0x7c/0x21c | simple_call_with_arg+0x50/0xc0 | optee_do_bottom_half+0x14/0x20 | notif_callback+0x3c/0x48 | handle_notif_callbacks+0x9c/0xe0 | notif_get_and_handle+0x40/0x88 | generic_exec_single+0x80/0xc0 | smp_call_function_single+0xfc/0x1a0 | notif_pcpu_irq_work_fn+0x2c/0x38 | process_one_work+0x14c/0x2b4 | worker_thread+0x2e4/0x3e0 | kthread+0x13c/0x210 | ret_from_fork+0x10/0x20 Solucione esto agregando una cola de trabajo para procesar la notificaci\u00f3n en un contexto no at\u00f3mico." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38375.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38375.json index 21a9506e365..86fe43386a7 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38375.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38375.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: ensure the received length does not exceed allocated size\n\nIn xdp_linearize_page, when reading the following buffers from the ring,\nwe forget to check the received length with the true allocate size. This\ncan lead to an out-of-bound read. This commit adds that missing check." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: virtio-net: garantizar que la longitud recibida no supere el tama\u00f1o asignado. En xdp_linearize_page, al leer los siguientes b\u00faferes del anillo, se olvida verificar la longitud recibida con el tama\u00f1o asignado real. Esto puede provocar una lectura fuera de los l\u00edmites. Este commit a\u00f1ade esta verificaci\u00f3n faltante." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38376.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38376.json index 219e44d6a80..27ced22d92a 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38376.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38376.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: udc: disconnect/reconnect from host when do suspend/resume\n\nShawn and John reported a hang issue during system suspend as below:\n\n - USB gadget is enabled as Ethernet\n - There is data transfer over USB Ethernet (scp a big file between host\n and device)\n - Device is going in/out suspend (echo mem > /sys/power/state)\n\nThe root cause is the USB device controller is suspended but the USB bus\nis still active which caused the USB host continues to transfer data with\ndevice and the device continues to queue USB requests (in this case, a\ndelayed TCP ACK packet trigger the issue) after controller is suspended,\nhowever the USB controller clock is already gated off. Then if udc driver\naccess registers after that point, the system will hang.\n\nThe correct way to avoid such issue is to disconnect device from host when\nthe USB bus is not at suspend state. Then the host will receive disconnect\nevent and stop data transfer in time. To continue make USB gadget device\nwork after system resume, this will reconnect device automatically.\n\nTo make usb wakeup work if USB bus is already at suspend state, this will\nkeep connection for it only when USB device controller has enabled wakeup\ncapability." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: chipidea: udc: desconectar/reconectar del host al suspender/reanudar Shawn y John informaron de un problema de cuelgue durante la suspensi\u00f3n del sistema como se muestra a continuaci\u00f3n: - El dispositivo USB est\u00e1 habilitado como Ethernet - Hay transferencia de datos a trav\u00e9s de USB Ethernet (scp un archivo grande entre el host y el dispositivo) - El dispositivo entra/sale de suspensi\u00f3n (echo mem > /sys/power/state) La causa ra\u00edz es que el controlador del dispositivo USB est\u00e1 suspendido, pero el bus USB sigue activo, lo que provoc\u00f3 que el host USB siguiera transfiriendo datos con el dispositivo y el dispositivo siguiera poniendo en cola las solicitudes USB (en este caso, un paquete TCP ACK retrasado desencaden\u00f3 el problema) despu\u00e9s de que el controlador se suspendiera; sin embargo, el reloj del controlador USB ya estaba desactivado. Entonces, si el acceso al controlador udc se registra despu\u00e9s de ese punto, el sistema se colgar\u00e1. La forma correcta de evitar este problema es desconectar el dispositivo del host cuando el bus USB no est\u00e9 en estado de suspensi\u00f3n. Entonces, el host recibir\u00e1 el evento de desconexi\u00f3n y detendr\u00e1 la transferencia de datos a tiempo. Para que el dispositivo USB siga funcionando despu\u00e9s de reanudar el sistema, esto volver\u00e1 a conectar el dispositivo autom\u00e1ticamente. Para que la activaci\u00f3n USB funcione si el bus USB ya est\u00e1 en estado de suspensi\u00f3n, esto mantendr\u00e1 la conexi\u00f3n solo cuando el controlador del dispositivo USB haya habilitado la capacidad de activaci\u00f3n." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38377.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38377.json index f319d175e92..05f3984996d 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38377.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38377.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrose: fix dangling neighbour pointers in rose_rt_device_down()\n\nThere are two bugs in rose_rt_device_down() that can cause\nuse-after-free:\n\n1. The loop bound `t->count` is modified within the loop, which can\n cause the loop to terminate early and miss some entries.\n\n2. When removing an entry from the neighbour array, the subsequent entries\n are moved up to fill the gap, but the loop index `i` is still\n incremented, causing the next entry to be skipped.\n\nFor example, if a node has three neighbours (A, A, B) with count=3 and A\nis being removed, the second A is not checked.\n\n i=0: (A, A, B) -> (A, B) with count=2\n ^ checked\n i=1: (A, B) -> (A, B) with count=2\n ^ checked (B, not A!)\n i=2: (doesn't occur because i < count is false)\n\nThis leaves the second A in the array with count=2, but the rose_neigh\nstructure has been freed. Code that accesses these entries assumes that\nthe first `count` entries are valid pointers, causing a use-after-free\nwhen it accesses the dangling pointer.\n\nFix both issues by iterating over the array in reverse order with a fixed\nloop bound. This ensures that all entries are examined and that the removal\nof an entry doesn't affect subsequent iterations." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rose: correcci\u00f3n de punteros vecinos colgantes en rose_rt_device_down(). Hay dos errores en rose_rt_device_down() que pueden causar un use-after-free: 1. El l\u00edmite del bucle `t->count` se modifica dentro del bucle, lo que puede provocar que el bucle termine antes de tiempo y se pierdan algunas entradas. 2. Al eliminar una entrada de la matriz de vecinos, las entradas posteriores se mueven hacia arriba para llenar el espacio vac\u00edo, pero el \u00edndice del bucle `i` a\u00fan se incrementa, lo que hace que se omita la siguiente entrada. Por ejemplo, si un nodo tiene tres vecinos (A, A, B) con count=3 y se est\u00e1 eliminando A, no se comprueba el segundo A. i=0: (A, A, B) -> (A, B) con count=2 ^ comprobado i=1: (A, B) -> (A, B) con count=2 ^ comprobado (\u00a1B, no A!) i=2: (no ocurre porque i < count es falso) Esto deja la segunda A en el array con count=2, pero la estructura rose_neigh se ha liberado. El c\u00f3digo que accede a estas entradas asume que las primeras entradas de `count` son punteros v\u00e1lidos, lo que provoca un use-after-free al acceder al puntero colgante. Solucione ambos problemas iterando sobre el array en orden inverso con un l\u00edmite de bucle fijo. Esto garantiza que se examinen todas las entradas y que la eliminaci\u00f3n de una entrada no afecte a las iteraciones posteriores." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38378.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38378.json index 1eee1cca938..1626f5c84fb 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38378.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38378.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe\n\nIn probe appletb_kbd_probe() a \"struct appletb_kbd *kbd\" is allocated\nvia devm_kzalloc() to store touch bar keyboard related data.\nLater on if backlight_device_get_by_name() finds a backlight device\nwith name \"appletb_backlight\" a timer (kbd->inactivity_timer) is setup\nwith appletb_inactivity_timer() and the timer is armed to run after\nappletb_tb_dim_timeout (60) seconds.\n\nA use-after-free is triggered when failure occurs after the timer is\narmed. This ultimately means probe failure occurs and as a result the\n\"struct appletb_kbd *kbd\" which is device managed memory is freed.\nAfter 60 seconds the timer will have expired and __run_timers will\nattempt to access the timer (kbd->inactivity_timer) however the kdb\nstructure has been freed causing a use-after free.\n\n[ 71.636938] ==================================================================\n[ 71.637915] BUG: KASAN: slab-use-after-free in __run_timers+0x7ad/0x890\n[ 71.637915] Write of size 8 at addr ffff8881178c5958 by task swapper/1/0\n[ 71.637915]\n[ 71.637915] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-rc2-00318-g739a6c93cc75-dirty #12 PREEMPT(voluntary)\n[ 71.637915] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n[ 71.637915] Call Trace:\n[ 71.637915] \n[ 71.637915] dump_stack_lvl+0x53/0x70\n[ 71.637915] print_report+0xce/0x670\n[ 71.637915] ? __run_timers+0x7ad/0x890\n[ 71.637915] kasan_report+0xce/0x100\n[ 71.637915] ? __run_timers+0x7ad/0x890\n[ 71.637915] __run_timers+0x7ad/0x890\n[ 71.637915] ? __pfx___run_timers+0x10/0x10\n[ 71.637915] ? update_process_times+0xfc/0x190\n[ 71.637915] ? __pfx_update_process_times+0x10/0x10\n[ 71.637915] ? _raw_spin_lock_irq+0x80/0xe0\n[ 71.637915] ? _raw_spin_lock_irq+0x80/0xe0\n[ 71.637915] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 71.637915] run_timer_softirq+0x141/0x240\n[ 71.637915] ? __pfx_run_timer_softirq+0x10/0x10\n[ 71.637915] ? __pfx___hrtimer_run_queues+0x10/0x10\n[ 71.637915] ? kvm_clock_get_cycles+0x18/0x30\n[ 71.637915] ? ktime_get+0x60/0x140\n[ 71.637915] handle_softirqs+0x1b8/0x5c0\n[ 71.637915] ? __pfx_handle_softirqs+0x10/0x10\n[ 71.637915] irq_exit_rcu+0xaf/0xe0\n[ 71.637915] sysvec_apic_timer_interrupt+0x6c/0x80\n[ 71.637915] \n[ 71.637915]\n[ 71.637915] Allocated by task 39:\n[ 71.637915] kasan_save_stack+0x33/0x60\n[ 71.637915] kasan_save_track+0x14/0x30\n[ 71.637915] __kasan_kmalloc+0x8f/0xa0\n[ 71.637915] __kmalloc_node_track_caller_noprof+0x195/0x420\n[ 71.637915] devm_kmalloc+0x74/0x1e0\n[ 71.637915] appletb_kbd_probe+0x37/0x3c0\n[ 71.637915] hid_device_probe+0x2d1/0x680\n[ 71.637915] really_probe+0x1c3/0x690\n[ 71.637915] __driver_probe_device+0x247/0x300\n[ 71.637915] driver_probe_device+0x49/0x210\n[...]\n[ 71.637915]\n[ 71.637915] Freed by task 39:\n[ 71.637915] kasan_save_stack+0x33/0x60\n[ 71.637915] kasan_save_track+0x14/0x30\n[ 71.637915] kasan_save_free_info+0x3b/0x60\n[ 71.637915] __kasan_slab_free+0x37/0x50\n[ 71.637915] kfree+0xcf/0x360\n[ 71.637915] devres_release_group+0x1f8/0x3c0\n[ 71.637915] hid_device_probe+0x315/0x680\n[ 71.637915] really_probe+0x1c3/0x690\n[ 71.637915] __driver_probe_device+0x247/0x300\n[ 71.637915] driver_probe_device+0x49/0x210\n[...]\n\nThe root cause of the issue is that the timer is not disarmed\non failure paths leading to it remaining active and accessing\nfreed memory. To fix this call timer_delete_sync() to deactivate\nthe timer.\n\nAnother small issue is that timer_delete_sync is called\nunconditionally in appletb_kbd_remove(), fix this by checking\nfor a valid kbd->backlight_dev before calling timer_delete_sync." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: HID: appletb-kbd: correcci\u00f3n de use-after-free de slab en appletb_kbd_probe. En la sonda appletb_kbd_probe(), se asigna una estructura \"struct appletb_kbd *kbd\" mediante devm_kzalloc() para almacenar datos relacionados con el teclado de la barra t\u00e1ctil. Posteriormente, si backlight_device_get_by_name() encuentra un dispositivo de retroiluminaci\u00f3n con el nombre \"appletb_backlight\", se configura un temporizador (kbd->inactivity_timer) con appletb_inactivity_timer() y se arma para que se ejecute despu\u00e9s de appletb_tb_dim_timeout (60) segundos. Se activa un uso tras liberaci\u00f3n cuando se produce un fallo despu\u00e9s de que el temporizador est\u00e9 armado. Esto, en \u00faltima instancia, significa que se produce un fallo en la sonda y, como resultado, se libera la estructura \"struct appletb_kbd *kbd\", que es la memoria administrada por el dispositivo. Despu\u00e9s de 60 segundos, el temporizador habr\u00e1 expirado y __run_timers intentar\u00e1 acceder al temporizador (kbd->inactivity_timer); sin embargo, la estructura kdb se habr\u00e1 liberado, lo que provocar\u00e1 un use-after-free. [ 71.636938] ================================================================== [ 71.637915] BUG: KASAN: slab-use-after-free in __run_timers+0x7ad/0x890 [ 71.637915] Write of size 8 at addr ffff8881178c5958 by task swapper/1/0 [ 71.637915] [ 71.637915] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-rc2-00318-g739a6c93cc75-dirty #12 PREEMPT(voluntary) [ 71.637915] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 71.637915] Call Trace: [ 71.637915] [ 71.637915] dump_stack_lvl+0x53/0x70 [ 71.637915] print_report+0xce/0x670 [ 71.637915] ? __run_timers+0x7ad/0x890 [ 71.637915] kasan_report+0xce/0x100 [ 71.637915] ? __run_timers+0x7ad/0x890 [ 71.637915] __run_timers+0x7ad/0x890 [ 71.637915] ? __pfx___run_timers+0x10/0x10 [ 71.637915] ? update_process_times+0xfc/0x190 [ 71.637915] ? __pfx_update_process_times+0x10/0x10 [ 71.637915] ? _raw_spin_lock_irq+0x80/0xe0 [ 71.637915] ? _raw_spin_lock_irq+0x80/0xe0 [ 71.637915] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 71.637915] run_timer_softirq+0x141/0x240 [ 71.637915] ? __pfx_run_timer_softirq+0x10/0x10 [ 71.637915] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 71.637915] ? kvm_clock_get_cycles+0x18/0x30 [ 71.637915] ? ktime_get+0x60/0x140 [ 71.637915] handle_softirqs+0x1b8/0x5c0 [ 71.637915] ? __pfx_handle_softirqs+0x10/0x10 [ 71.637915] irq_exit_rcu+0xaf/0xe0 [ 71.637915] sysvec_apic_timer_interrupt+0x6c/0x80 [ 71.637915] [ 71.637915] [ 71.637915] Allocated by task 39: [ 71.637915] kasan_save_stack+0x33/0x60 [ 71.637915] kasan_save_track+0x14/0x30 [ 71.637915] __kasan_kmalloc+0x8f/0xa0 [ 71.637915] __kmalloc_node_track_caller_noprof+0x195/0x420 [ 71.637915] devm_kmalloc+0x74/0x1e0 [ 71.637915] appletb_kbd_probe+0x37/0x3c0 [ 71.637915] hid_device_probe+0x2d1/0x680 [ 71.637915] really_probe+0x1c3/0x690 [ 71.637915] __driver_probe_device+0x247/0x300 [ 71.637915] driver_probe_device+0x49/0x210 [...] [ 71.637915] [ 71.637915] Freed by task 39: [ 71.637915] kasan_save_stack+0x33/0x60 [ 71.637915] kasan_save_track+0x14/0x30 [ 71.637915] kasan_save_free_info+0x3b/0x60 [ 71.637915] __kasan_slab_free+0x37/0x50 [ 71.637915] kfree+0xcf/0x360 [ 71.637915] devres_release_group+0x1f8/0x3c0 [ 71.637915] hid_device_probe+0x315/0x680 [ 71.637915] really_probe+0x1c3/0x690 [ 71.637915] __driver_probe_device+0x247/0x300 [ 71.637915] driver_probe_device+0x49/0x210 [...] La causa principal del problema es que el temporizador no se desactiva en rutas de fallo, lo que provoca que permanezca activo y acceda a la memoria liberada. Para solucionar esto, llame a timer_delete_sync() para desactivarlo. Otro peque\u00f1o problema es que timer_delete_sync se llama incondicionalmente en appletb_kbd_remove(). Para solucionarlo, compruebe si hay un `kbd->backlight_dev` v\u00e1lido antes de llamar a timer_delete_sync." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38379.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38379.json index b059c9dfafe..4299a9b66c2 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38379.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38379.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix warning when reconnecting channel\n\nWhen reconnecting a channel in smb2_reconnect_server(), a dummy tcon\nis passed down to smb2_reconnect() with ->query_interface\nuninitialized, so we can't call queue_delayed_work() on it.\n\nFix the following warning by ensuring that we're queueing the delayed\nworker from correct tcon.\n\nWARNING: CPU: 4 PID: 1126 at kernel/workqueue.c:2498 __queue_delayed_work+0x1d2/0x200\nModules linked in: cifs cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs]\nCPU: 4 UID: 0 PID: 1126 Comm: kworker/4:0 Not tainted 6.16.0-rc3 #5 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.fc42 04/01/2014\nWorkqueue: cifsiod smb2_reconnect_server [cifs]\nRIP: 0010:__queue_delayed_work+0x1d2/0x200\nCode: 41 5e 41 5f e9 7f ee ff ff 90 0f 0b 90 e9 5d ff ff ff bf 02 00\n00 00 e8 6c f3 07 00 89 c3 eb bd 90 0f 0b 90 e9 57 f> 0b 90 e9 65 fe\nff ff 90 0f 0b 90 e9 72 fe ff ff 90 0f 0b 90 e9\nRSP: 0018:ffffc900014afad8 EFLAGS: 00010003\nRAX: 0000000000000000 RBX: ffff888124d99988 RCX: ffffffff81399cc1\nRDX: dffffc0000000000 RSI: ffff888114326e00 RDI: ffff888124d999f0\nRBP: 000000000000ea60 R08: 0000000000000001 R09: ffffed10249b3331\nR10: ffff888124d9998f R11: 0000000000000004 R12: 0000000000000040\nR13: ffff888114326e00 R14: ffff888124d999d8 R15: ffff888114939020\nFS: 0000000000000000(0000) GS:ffff88829f7fe000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffe7a2b4038 CR3: 0000000120a6f000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n \n queue_delayed_work_on+0xb4/0xc0\n smb2_reconnect+0xb22/0xf50 [cifs]\n smb2_reconnect_server+0x413/0xd40 [cifs]\n ? __pfx_smb2_reconnect_server+0x10/0x10 [cifs]\n ? local_clock_noinstr+0xd/0xd0\n ? local_clock+0x15/0x30\n ? lock_release+0x29b/0x390\n process_one_work+0x4c5/0xa10\n ? __pfx_process_one_work+0x10/0x10\n ? __list_add_valid_or_report+0x37/0x120\n worker_thread+0x2f1/0x5a0\n ? __kthread_parkme+0xde/0x100\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1fe/0x380\n ? kthread+0x10f/0x380\n ? __pfx_kthread+0x10/0x10\n ? local_clock_noinstr+0xd/0xd0\n ? ret_from_fork+0x1b/0x1f0\n ? local_clock+0x15/0x30\n ? lock_release+0x29b/0x390\n ? rcu_is_watching+0x20/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x15b/0x1f0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \nirq event stamp: 1116206\nhardirqs last enabled at (1116205): [] __up_console_sem+0x52/0x60\nhardirqs last disabled at (1116206): [] queue_delayed_work_on+0x6e/0xc0\nsoftirqs last enabled at (1116138): [] __smb_send_rqst+0x42d/0x950 [cifs]\nsoftirqs last disabled at (1116136): [] release_sock+0x21/0xf0" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: se corrige la advertencia al reconectar el canal. Al reconectar un canal en smb2_reconnect_server(), se pasa una transacci\u00f3n ficticia a smb2_reconnect() con ->query_interface sin inicializar, por lo que no se puede ejecutar queue_delayed_work() en ella. Corrija la siguiente advertencia asegur\u00e1ndose de que se est\u00e9 poniendo en cola el trabajador retrasado desde la transacci\u00f3n correcta. WARNING: CPU: 4 PID: 1126 at kernel/workqueue.c:2498 __queue_delayed_work+0x1d2/0x200 Modules linked in: cifs cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs] CPU: 4 UID: 0 PID: 1126 Comm: kworker/4:0 Not tainted 6.16.0-rc3 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.fc42 04/01/2014 Workqueue: cifsiod smb2_reconnect_server [cifs] RIP: 0010:__queue_delayed_work+0x1d2/0x200 Code: 41 5e 41 5f e9 7f ee ff ff 90 0f 0b 90 e9 5d ff ff ff bf 02 00 00 00 e8 6c f3 07 00 89 c3 eb bd 90 0f 0b 90 e9 57 f> 0b 90 e9 65 fe ff ff 90 0f 0b 90 e9 72 fe ff ff 90 0f 0b 90 e9 RSP: 0018:ffffc900014afad8 EFLAGS: 00010003 RAX: 0000000000000000 RBX: ffff888124d99988 RCX: ffffffff81399cc1 RDX: dffffc0000000000 RSI: ffff888114326e00 RDI: ffff888124d999f0 RBP: 000000000000ea60 R08: 0000000000000001 R09: ffffed10249b3331 R10: ffff888124d9998f R11: 0000000000000004 R12: 0000000000000040 R13: ffff888114326e00 R14: ffff888124d999d8 R15: ffff888114939020 FS: 0000000000000000(0000) GS:ffff88829f7fe000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe7a2b4038 CR3: 0000000120a6f000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: queue_delayed_work_on+0xb4/0xc0 smb2_reconnect+0xb22/0xf50 [cifs] smb2_reconnect_server+0x413/0xd40 [cifs] ? __pfx_smb2_reconnect_server+0x10/0x10 [cifs] ? local_clock_noinstr+0xd/0xd0 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 process_one_work+0x4c5/0xa10 ? __pfx_process_one_work+0x10/0x10 ? __list_add_valid_or_report+0x37/0x120 worker_thread+0x2f1/0x5a0 ? __kthread_parkme+0xde/0x100 ? __pfx_worker_thread+0x10/0x10 kthread+0x1fe/0x380 ? kthread+0x10f/0x380 ? __pfx_kthread+0x10/0x10 ? local_clock_noinstr+0xd/0xd0 ? ret_from_fork+0x1b/0x1f0 ? local_clock+0x15/0x30 ? lock_release+0x29b/0x390 ? rcu_is_watching+0x20/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x15b/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 irq event stamp: 1116206 hardirqs last enabled at (1116205): [] __up_console_sem+0x52/0x60 hardirqs last disabled at (1116206): [] queue_delayed_work_on+0x6e/0xc0 softirqs last enabled at (1116138): [] __smb_send_rqst+0x42d/0x950 [cifs] softirqs last disabled at (1116136): [] release_sock+0x21/0xf0" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38380.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38380.json index 298f03be359..090450138f3 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38380.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38380.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c/designware: Fix an initialization issue\n\nThe i2c_dw_xfer_init() function requires msgs and msg_write_idx from the\ndev context to be initialized.\n\namd_i2c_dw_xfer_quirk() inits msgs and msgs_num, but not msg_write_idx.\n\nThis could allow an out of bounds access (of msgs).\n\nInitialize msg_write_idx before calling i2c_dw_xfer_init()." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i2c/designware: Se solucion\u00f3 un problema de inicializaci\u00f3n. La funci\u00f3n i2c_dw_xfer_init() requiere que se inicialicen msgs y msg_write_idx del contexto de desarrollo. amd_i2c_dw_xfer_quirk() inicializa msgs y msgs_num, pero no msg_write_idx. Esto podr\u00eda permitir un acceso fuera de los l\u00edmites de msgs. Inicialice msg_write_idx antes de llamar a i2c_dw_xfer_init()." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38381.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38381.json index 836b454fb3c..d613f637abc 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38381.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38381.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt()\n\nThe cs40l50_upload_owt() function allocates memory via kmalloc()\nwithout checking for allocation failure, which could lead to a\nNULL pointer dereference.\n\nReturn -ENOMEM in case allocation fails." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Entrada: cs40l50-vibra - Se corrige una posible desreferencia de NULL en cs40l50_upload_owt(). La funci\u00f3n cs40l50_upload_owt() asigna memoria mediante kmalloc() sin comprobar si hay fallos de asignaci\u00f3n, lo que podr\u00eda provocar una desreferencia de puntero NULL. Devuelve -ENOMEM en caso de fallo de asignaci\u00f3n." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38382.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38382.json index f4c1a740082..7f335415725 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38382.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38382.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix iteration of extrefs during log replay\n\nAt __inode_add_ref() when processing extrefs, if we jump into the next\nlabel we have an undefined value of victim_name.len, since we haven't\ninitialized it before we did the goto. This results in an invalid memory\naccess in the next iteration of the loop since victim_name.len was not\ninitialized to the length of the name of the current extref.\n\nFix this by initializing victim_name.len with the current extref's name\nlength." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: correcci\u00f3n de la iteraci\u00f3n de referencias externas durante la reproducci\u00f3n del registro. En __inode_add_ref(), al procesar referencias externas, si saltamos a la siguiente etiqueta, obtenemos un valor indefinido de victim_name.len, ya que no lo inicializamos antes de ejecutar el comando goto. Esto provoca un acceso a memoria no v\u00e1lido en la siguiente iteraci\u00f3n del bucle, ya que victim_name.len no se inicializ\u00f3 con la longitud del nombre de la referencia externa actual. Para solucionar esto, inicialice victim_name.len con la longitud del nombre de la referencia externa actual." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38383.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38383.json index 8f6caa32e8e..5409f950747 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38383.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38383.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: fix data race in show_numa_info()\n\nThe following data-race was found in show_numa_info():\n\n==================================================================\nBUG: KCSAN: data-race in vmalloc_info_show / vmalloc_info_show\n\nread to 0xffff88800971fe30 of 4 bytes by task 8289 on cpu 0:\n show_numa_info mm/vmalloc.c:4936 [inline]\n vmalloc_info_show+0x5a8/0x7e0 mm/vmalloc.c:5016\n seq_read_iter+0x373/0xb40 fs/seq_file.c:230\n proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299\n....\n\nwrite to 0xffff88800971fe30 of 4 bytes by task 8287 on cpu 1:\n show_numa_info mm/vmalloc.c:4934 [inline]\n vmalloc_info_show+0x38f/0x7e0 mm/vmalloc.c:5016\n seq_read_iter+0x373/0xb40 fs/seq_file.c:230\n proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299\n....\n\nvalue changed: 0x0000008f -> 0x00000000\n==================================================================\n\nAccording to this report,there is a read/write data-race because\nm->private is accessible to multiple CPUs. To fix this, instead of\nallocating the heap in proc_vmalloc_init() and passing the heap address to\nm->private, vmalloc_info_show() should allocate the heap." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/vmalloc: correcci\u00f3n de la ejecuci\u00f3n de datos en show_numa_info() Se encontr\u00f3 la siguiente ejecuci\u00f3n de datos en show_numa_info(): ================================================================== BUG: KCSAN: data-race in vmalloc_info_show / vmalloc_info_show read to 0xffff88800971fe30 of 4 bytes by task 8289 on cpu 0: show_numa_info mm/vmalloc.c:4936 [inline] vmalloc_info_show+0x5a8/0x7e0 mm/vmalloc.c:5016 seq_read_iter+0x373/0xb40 fs/seq_file.c:230 proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299 .... write to 0xffff88800971fe30 of 4 bytes by task 8287 on cpu 1: show_numa_info mm/vmalloc.c:4934 [inline] vmalloc_info_show+0x38f/0x7e0 mm/vmalloc.c:5016 seq_read_iter+0x373/0xb40 fs/seq_file.c:230 proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299 .... value changed: 0x0000008f -> 0x00000000 ================================================================== Seg\u00fan este informe, existe una competencia de lectura/escritura de datos porque m->private es accesible a varias CPU. Para solucionar esto, en lugar de asignar el mont\u00f3n en proc_vmalloc_init() y pasar la direcci\u00f3n del mont\u00f3n a m->private, vmalloc_info_show() deber\u00eda asignarlo." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38384.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38384.json index 15da1b88e84..44ce7cc9c61 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38384.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38384.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: spinand: fix memory leak of ECC engine conf\n\nMemory allocated for the ECC engine conf is not released during spinand\ncleanup. Below kmemleak trace is seen for this memory leak:\n\nunreferenced object 0xffffff80064f00e0 (size 8):\n comm \"swapper/0\", pid 1, jiffies 4294937458\n hex dump (first 8 bytes):\n 00 00 00 00 00 00 00 00 ........\n backtrace (crc 0):\n kmemleak_alloc+0x30/0x40\n __kmalloc_cache_noprof+0x208/0x3c0\n spinand_ondie_ecc_init_ctx+0x114/0x200\n nand_ecc_init_ctx+0x70/0xa8\n nanddev_ecc_engine_init+0xec/0x27c\n spinand_probe+0xa2c/0x1620\n spi_mem_probe+0x130/0x21c\n spi_probe+0xf0/0x170\n really_probe+0x17c/0x6e8\n __driver_probe_device+0x17c/0x21c\n driver_probe_device+0x58/0x180\n __device_attach_driver+0x15c/0x1f8\n bus_for_each_drv+0xec/0x150\n __device_attach+0x188/0x24c\n device_initial_probe+0x10/0x20\n bus_probe_device+0x11c/0x160\n\nFix the leak by calling nanddev_ecc_engine_cleanup() inside\nspinand_cleanup()." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mtd: spinand: corrige p\u00e9rdida de memoria de la configuraci\u00f3n del motor ECC. La memoria asignada para la configuraci\u00f3n del motor ECC no se libera durante la limpieza de spinand. A continuaci\u00f3n se ve el rastro de kmemleak para esta p\u00e9rdida de memoria: objeto sin referencia 0xffffff80064f00e0 (tama\u00f1o 8): comm \"swapper/0\", pid 1, jiffies 4294937458 volcado hexadecimal (primeros 8 bytes): 00 00 00 00 00 00 00 00 ........ backtrace (crc 0): kmemleak_alloc+0x30/0x40 __kmalloc_cache_noprof+0x208/0x3c0 spinand_ondie_ecc_init_ctx+0x114/0x200 nand_ecc_init_ctx+0x70/0xa8 nanddev_ecc_engine_init+0xec/0x27c spinand_probe+0xa2c/0x1620 Corrija la p\u00e9rdida llamando a nanddev_ecc_engine_cleanup() dentro de spinand_cleanup()." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38385.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38385.json index dcb7fbfb566..987e38bf70b 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38385.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38385.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect\n\nRemove redundant netif_napi_del() call from disconnect path.\n\nA WARN may be triggered in __netif_napi_del_locked() during USB device\ndisconnect:\n\n WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350\n\nThis happens because netif_napi_del() is called in the disconnect path while\nNAPI is still enabled. However, it is not necessary to call netif_napi_del()\nexplicitly, since unregister_netdev() will handle NAPI teardown automatically\nand safely. Removing the redundant call avoids triggering the warning.\n\nFull trace:\n lan78xx 1-1:1.0 enu1: Failed to read register index 0x000000c4. ret = -ENODEV\n lan78xx 1-1:1.0 enu1: Failed to set MAC down with error -ENODEV\n lan78xx 1-1:1.0 enu1: Link is Down\n lan78xx 1-1:1.0 enu1: Failed to read register index 0x00000120. ret = -ENODEV\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350\n Modules linked in: flexcan can_dev fuse\n CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.0-rc2-00624-ge926949dab03 #9 PREEMPT\n Hardware name: SKOV IMX8MP CPU revC - bd500 (DT)\n Workqueue: usb_hub_wq hub_event\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __netif_napi_del_locked+0x2b4/0x350\n lr : __netif_napi_del_locked+0x7c/0x350\n sp : ffffffc085b673c0\n x29: ffffffc085b673c0 x28: ffffff800b7f2000 x27: ffffff800b7f20d8\n x26: ffffff80110bcf58 x25: ffffff80110bd978 x24: 1ffffff0022179eb\n x23: ffffff80110bc000 x22: ffffff800b7f5000 x21: ffffff80110bc000\n x20: ffffff80110bcf38 x19: ffffff80110bcf28 x18: dfffffc000000000\n x17: ffffffc081578940 x16: ffffffc08284cee0 x15: 0000000000000028\n x14: 0000000000000006 x13: 0000000000040000 x12: ffffffb0022179e8\n x11: 1ffffff0022179e7 x10: ffffffb0022179e7 x9 : dfffffc000000000\n x8 : 0000004ffdde8619 x7 : ffffff80110bcf3f x6 : 0000000000000001\n x5 : ffffff80110bcf38 x4 : ffffff80110bcf38 x3 : 0000000000000000\n x2 : 0000000000000000 x1 : 1ffffff0022179e7 x0 : 0000000000000000\n Call trace:\n __netif_napi_del_locked+0x2b4/0x350 (P)\n lan78xx_disconnect+0xf4/0x360\n usb_unbind_interface+0x158/0x718\n device_remove+0x100/0x150\n device_release_driver_internal+0x308/0x478\n device_release_driver+0x1c/0x30\n bus_remove_device+0x1a8/0x368\n device_del+0x2e0/0x7b0\n usb_disable_device+0x244/0x540\n usb_disconnect+0x220/0x758\n hub_event+0x105c/0x35e0\n process_one_work+0x760/0x17b0\n worker_thread+0x768/0xce8\n kthread+0x3bc/0x690\n ret_from_fork+0x10/0x20\n irq event stamp: 211604\n hardirqs last enabled at (211603): [] _raw_spin_unlock_irqrestore+0x84/0x98\n hardirqs last disabled at (211604): [] el1_dbg+0x24/0x80\n softirqs last enabled at (211296): [] handle_softirqs+0x820/0xbc8\n softirqs last disabled at (210993): [] __do_softirq+0x18/0x20\n ---[ end trace 0000000000000000 ]---\n lan78xx 1-1:1.0 enu1: failed to kill vid 0081/0" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: usb: lan78xx: correcci\u00f3n de WARN en __netif_napi_del_locked al desconectar Eliminar la llamada redundante netif_napi_del() de la ruta de desconexi\u00f3n. Se puede activar una WARN en __netif_napi_del_locked() durante la desconexi\u00f3n del dispositivo USB: WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350 This happens because netif_napi_del() is called in the disconnect path while NAPI is still enabled. However, it is not necessary to call netif_napi_del() explicitly, since unregister_netdev() will handle NAPI teardown automatically and safely. Removing the redundant call avoids triggering the warning. Full trace: lan78xx 1-1:1.0 enu1: Failed to read register index 0x000000c4. ret = -ENODEV lan78xx 1-1:1.0 enu1: Failed to set MAC down with error -ENODEV lan78xx 1-1:1.0 enu1: Link is Down lan78xx 1-1:1.0 enu1: Failed to read register index 0x00000120. ret = -ENODEV ------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350 Modules linked in: flexcan can_dev fuse CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.0-rc2-00624-ge926949dab03 #9 PREEMPT Hardware name: SKOV IMX8MP CPU revC - bd500 (DT) Workqueue: usb_hub_wq hub_event pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __netif_napi_del_locked+0x2b4/0x350 lr : __netif_napi_del_locked+0x7c/0x350 sp : ffffffc085b673c0 x29: ffffffc085b673c0 x28: ffffff800b7f2000 x27: ffffff800b7f20d8 x26: ffffff80110bcf58 x25: ffffff80110bd978 x24: 1ffffff0022179eb x23: ffffff80110bc000 x22: ffffff800b7f5000 x21: ffffff80110bc000 x20: ffffff80110bcf38 x19: ffffff80110bcf28 x18: dfffffc000000000 x17: ffffffc081578940 x16: ffffffc08284cee0 x15: 0000000000000028 x14: 0000000000000006 x13: 0000000000040000 x12: ffffffb0022179e8 x11: 1ffffff0022179e7 x10: ffffffb0022179e7 x9 : dfffffc000000000 x8 : 0000004ffdde8619 x7 : ffffff80110bcf3f x6 : 0000000000000001 x5 : ffffff80110bcf38 x4 : ffffff80110bcf38 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 1ffffff0022179e7 x0 : 0000000000000000 Call trace: __netif_napi_del_locked+0x2b4/0x350 (P) lan78xx_disconnect+0xf4/0x360 usb_unbind_interface+0x158/0x718 device_remove+0x100/0x150 device_release_driver_internal+0x308/0x478 device_release_driver+0x1c/0x30 bus_remove_device+0x1a8/0x368 device_del+0x2e0/0x7b0 usb_disable_device+0x244/0x540 usb_disconnect+0x220/0x758 hub_event+0x105c/0x35e0 process_one_work+0x760/0x17b0 worker_thread+0x768/0xce8 kthread+0x3bc/0x690 ret_from_fork+0x10/0x20 irq event stamp: 211604 hardirqs last enabled at (211603): [] _raw_spin_unlock_irqrestore+0x84/0x98 hardirqs last disabled at (211604): [] el1_dbg+0x24/0x80 softirqs last enabled at (211296): [] handle_softirqs+0x820/0xbc8 softirqs last disabled at (210993): [] __do_softirq+0x18/0x20 ---[ end trace 0000000000000000 ]--- lan78xx 1-1:1.0 enu1: failed to kill vid 0081/0" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38386.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38386.json index 0adde1d9d51..a41e4336288 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38386.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38386.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Refuse to evaluate a method if arguments are missing\n\nAs reported in [1], a platform firmware update that increased the number\nof method parameters and forgot to update a least one of its callers,\ncaused ACPICA to crash due to use-after-free.\n\nSince this a result of a clear AML issue that arguably cannot be fixed\nup by the interpreter (it cannot produce missing data out of thin air),\naddress it by making ACPICA refuse to evaluate a method if the caller\nattempts to pass fewer arguments than expected to it." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ACPICA: Negativa a evaluar un m\u00e9todo si faltan argumentos. Como se inform\u00f3 en [1], una actualizaci\u00f3n de firmware de la plataforma que aument\u00f3 el n\u00famero de par\u00e1metros del m\u00e9todo y olvid\u00f3 actualizar al menos uno de sus llamadores provoc\u00f3 el bloqueo de ACPICA debido al use-after-free. Dado que esto se debe a un claro problema de AML que posiblemente no pueda ser solucionado por el int\u00e9rprete (no puede generar datos faltantes de la nada), se debe solucionar haciendo que ACPICA se niegue a evaluar un m\u00e9todo si el llamante intenta pasarle menos argumentos de los esperados." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38387.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38387.json index 71f8fe9672a..7b94a004229 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38387.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38387.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert\n\nThe obj_event may be loaded immediately after inserted, then if the\nlist_head is not initialized then we may get a poisonous pointer. This\nfixes the crash below:\n\n mlx5_core 0000:03:00.0: MLX5E: StrdRq(1) RqSz(8) StrdSz(2048) RxCqeCmprss(0 enhanced)\n mlx5_core.sf mlx5_core.sf.4: firmware version: 32.38.3056\n mlx5_core 0000:03:00.0 en3f0pf0sf2002: renamed from eth0\n mlx5_core.sf mlx5_core.sf.4: Rate limit: 127 rates are supported, range: 0Mbps to 195312Mbps\n IPv6: ADDRCONF(NETDEV_CHANGE): en3f0pf0sf2002: link becomes ready\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060\n Mem abort info:\n ESR = 0x96000006\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n Data abort info:\n ISV = 0, ISS = 0x00000006\n CM = 0, WnR = 0\n user pgtable: 4k pages, 48-bit VAs, pgdp=00000007760fb000\n [0000000000000060] pgd=000000076f6d7003, p4d=000000076f6d7003, pud=0000000777841003, pmd=0000000000000000\n Internal error: Oops: 96000006 [#1] SMP\n Modules linked in: ipmb_host(OE) act_mirred(E) cls_flower(E) sch_ingress(E) mptcp_diag(E) udp_diag(E) raw_diag(E) unix_diag(E) tcp_diag(E) inet_diag(E) binfmt_misc(E) bonding(OE) rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) isofs(E) cdrom(E) mst_pciconf(OE) ib_umad(OE) mlx5_ib(OE) ipmb_dev_int(OE) mlx5_core(OE) kpatch_15237886(OEK) mlxdevm(OE) auxiliary(OE) ib_uverbs(OE) ib_core(OE) psample(E) mlxfw(OE) tls(E) sunrpc(E) vfat(E) fat(E) crct10dif_ce(E) ghash_ce(E) sha1_ce(E) sbsa_gwdt(E) virtio_console(E) ext4(E) mbcache(E) jbd2(E) xfs(E) libcrc32c(E) mmc_block(E) virtio_net(E) net_failover(E) failover(E) sha2_ce(E) sha256_arm64(E) nvme(OE) nvme_core(OE) gpio_mlxbf3(OE) mlx_compat(OE) mlxbf_pmc(OE) i2c_mlxbf(OE) sdhci_of_dwcmshc(OE) pinctrl_mlxbf3(OE) mlxbf_pka(OE) gpio_generic(E) i2c_core(E) mmc_core(E) mlxbf_gige(OE) vitesse(E) pwr_mlxbf(OE) mlxbf_tmfifo(OE) micrel(E) mlxbf_bootctl(OE) virtio_ring(E) virtio(E) ipmi_devintf(E) ipmi_msghandler(E)\n [last unloaded: mst_pci]\n CPU: 11 PID: 20913 Comm: rte-worker-11 Kdump: loaded Tainted: G OE K 5.10.134-13.1.an8.aarch64 #1\n Hardware name: https://www.mellanox.com BlueField-3 SmartNIC Main Card/BlueField-3 SmartNIC Main Card, BIOS 4.2.2.12968 Oct 26 2023\n pstate: a0400089 (NzCv daIf +PAN -UAO -TCO BTYPE=--)\n pc : dispatch_event_fd+0x68/0x300 [mlx5_ib]\n lr : devx_event_notifier+0xcc/0x228 [mlx5_ib]\n sp : ffff80001005bcf0\n x29: ffff80001005bcf0 x28: 0000000000000001\n x27: ffff244e0740a1d8 x26: ffff244e0740a1d0\n x25: ffffda56beff5ae0 x24: ffffda56bf911618\n x23: ffff244e0596a480 x22: ffff244e0596a480\n x21: ffff244d8312ad90 x20: ffff244e0596a480\n x19: fffffffffffffff0 x18: 0000000000000000\n x17: 0000000000000000 x16: ffffda56be66d620\n x15: 0000000000000000 x14: 0000000000000000\n x13: 0000000000000000 x12: 0000000000000000\n x11: 0000000000000040 x10: ffffda56bfcafb50\n x9 : ffffda5655c25f2c x8 : 0000000000000010\n x7 : 0000000000000000 x6 : ffff24545a2e24b8\n x5 : 0000000000000003 x4 : ffff80001005bd28\n x3 : 0000000000000000 x2 : 0000000000000000\n x1 : ffff244e0596a480 x0 : ffff244d8312ad90\n Call trace:\n dispatch_event_fd+0x68/0x300 [mlx5_ib]\n devx_event_notifier+0xcc/0x228 [mlx5_ib]\n atomic_notifier_call_chain+0x58/0x80\n mlx5_eq_async_int+0x148/0x2b0 [mlx5_core]\n atomic_notifier_call_chain+0x58/0x80\n irq_int_handler+0x20/0x30 [mlx5_core]\n __handle_irq_event_percpu+0x60/0x220\n handle_irq_event_percpu+0x3c/0x90\n handle_irq_event+0x58/0x158\n handle_fasteoi_irq+0xfc/0x188\n generic_handle_irq+0x34/0x48\n ..." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/mlx5: Inicializar obj_event->obj_sub_list antes de xa_insert. Obj_event se puede cargar inmediatamente despu\u00e9s de insertarlo, luego, si list_head no se inicializa, podemos obtener un puntero venenoso. Esto corrige el siguiente fallo: mlx5_core 0000:03:00.0: MLX5E: StrdRq(1) RqSz(8) StrdSz(2048) RxCqeCmprss(0 enhanced) mlx5_core.sf mlx5_core.sf.4: firmware version: 32.38.3056 mlx5_core 0000:03:00.0 en3f0pf0sf2002: renamed from eth0 mlx5_core.sf mlx5_core.sf.4: Rate limit: 127 rates are supported, range: 0Mbps to 195312Mbps IPv6: ADDRCONF(NETDEV_CHANGE): en3f0pf0sf2002: link becomes ready Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060 Mem abort info: ESR = 0x96000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000007760fb000 [0000000000000060] pgd=000000076f6d7003, p4d=000000076f6d7003, pud=0000000777841003, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] SMP Modules linked in: ipmb_host(OE) act_mirred(E) cls_flower(E) sch_ingress(E) mptcp_diag(E) udp_diag(E) raw_diag(E) unix_diag(E) tcp_diag(E) inet_diag(E) binfmt_misc(E) bonding(OE) rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) isofs(E) cdrom(E) mst_pciconf(OE) ib_umad(OE) mlx5_ib(OE) ipmb_dev_int(OE) mlx5_core(OE) kpatch_15237886(OEK) mlxdevm(OE) auxiliary(OE) ib_uverbs(OE) ib_core(OE) psample(E) mlxfw(OE) tls(E) sunrpc(E) vfat(E) fat(E) crct10dif_ce(E) ghash_ce(E) sha1_ce(E) sbsa_gwdt(E) virtio_console(E) ext4(E) mbcache(E) jbd2(E) xfs(E) libcrc32c(E) mmc_block(E) virtio_net(E) net_failover(E) failover(E) sha2_ce(E) sha256_arm64(E) nvme(OE) nvme_core(OE) gpio_mlxbf3(OE) mlx_compat(OE) mlxbf_pmc(OE) i2c_mlxbf(OE) sdhci_of_dwcmshc(OE) pinctrl_mlxbf3(OE) mlxbf_pka(OE) gpio_generic(E) i2c_core(E) mmc_core(E) mlxbf_gige(OE) vitesse(E) pwr_mlxbf(OE) mlxbf_tmfifo(OE) micrel(E) mlxbf_bootctl(OE) virtio_ring(E) virtio(E) ipmi_devintf(E) ipmi_msghandler(E) [last unloaded: mst_pci] CPU: 11 PID: 20913 Comm: rte-worker-11 Kdump: loaded Tainted: G OE K 5.10.134-13.1.an8.aarch64 #1 Hardware name: https://www.mellanox.com BlueField-3 SmartNIC Main Card/BlueField-3 SmartNIC Main Card, BIOS 4.2.2.12968 Oct 26 2023 pstate: a0400089 (NzCv daIf +PAN -UAO -TCO BTYPE=--) pc : dispatch_event_fd+0x68/0x300 [mlx5_ib] lr : devx_event_notifier+0xcc/0x228 [mlx5_ib] sp : ffff80001005bcf0 x29: ffff80001005bcf0 x28: 0000000000000001 x27: ffff244e0740a1d8 x26: ffff244e0740a1d0 x25: ffffda56beff5ae0 x24: ffffda56bf911618 x23: ffff244e0596a480 x22: ffff244e0596a480 x21: ffff244d8312ad90 x20: ffff244e0596a480 x19: fffffffffffffff0 x18: 0000000000000000 x17: 0000000000000000 x16: ffffda56be66d620 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000040 x10: ffffda56bfcafb50 x9 : ffffda5655c25f2c x8 : 0000000000000010 x7 : 0000000000000000 x6 : ffff24545a2e24b8 x5 : 0000000000000003 x4 : ffff80001005bd28 x3 : 0000000000000000 x2 : 0000000000000000 x1 : ffff244e0596a480 x0 : ffff244d8312ad90 Call trace: dispatch_event_fd+0x68/0x300 [mlx5_ib] devx_event_notifier+0xcc/0x228 [mlx5_ib] atomic_notifier_call_chain+0x58/0x80 mlx5_eq_async_int+0x148/0x2b0 [mlx5_core] atomic_notifier_call_chain+0x58/0x80 irq_int_handler+0x20/0x30 [mlx5_core] __handle_irq_event_percpu+0x60/0x220 handle_irq_event_percpu+0x3c/0x90 handle_irq_event+0x58/0x158 handle_fasteoi_irq+0xfc/0x188 generic_handle_irq+0x34/0x48 ..." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38388.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38388.json index 5294a70a8f5..5138b5c12df 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38388.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38388.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context\n\nThe current use of a mutex to protect the notifier hashtable accesses\ncan lead to issues in the atomic context. It results in the below\nkernel warnings:\n\n | BUG: sleeping function called from invalid context at kernel/locking/mutex.c:258\n | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0\n | preempt_count: 1, expected: 0\n | RCU nest depth: 0, expected: 0\n | CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.14.0 #4\n | Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn\n | Call trace:\n | show_stack+0x18/0x24 (C)\n | dump_stack_lvl+0x78/0x90\n | dump_stack+0x18/0x24\n | __might_resched+0x114/0x170\n | __might_sleep+0x48/0x98\n | mutex_lock+0x24/0x80\n | handle_notif_callbacks+0x54/0xe0\n | notif_get_and_handle+0x40/0x88\n | generic_exec_single+0x80/0xc0\n | smp_call_function_single+0xfc/0x1a0\n | notif_pcpu_irq_work_fn+0x2c/0x38\n | process_one_work+0x14c/0x2b4\n | worker_thread+0x2e4/0x3e0\n | kthread+0x13c/0x210\n | ret_from_fork+0x10/0x20\n\nTo address this, replace the mutex with an rwlock to protect the notifier\nhashtable accesses. This ensures that read-side locking does not sleep and\nmultiple readers can acquire the lock concurrently, avoiding unnecessary\ncontention and potential deadlocks. Writer access remains exclusive,\npreserving correctness.\n\nThis change resolves warnings from lockdep about potential sleep in\natomic context." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: arm_ffa: Reemplazar mutex por rwlock para evitar la suspensi\u00f3n en contexto at\u00f3mico El uso actual de un mutex para proteger los accesos a la tabla hash del notificador puede provocar problemas en el contexto at\u00f3mico. Esto da como resultado las siguientes advertencias del kernel: | BUG: funci\u00f3n de suspensi\u00f3n llamada desde un contexto no v\u00e1lido en kernel/locking/mutex.c:258 | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 9, name: kworker/0:0 | preempt_count: 1, expected: 0 | RCU nest Depth: 0, expected: 0 | CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 No contaminado 6.14.0 #4 | Workqueue: ffa_pcpu_irq_notification notif_pcpu_irq_work_fn | Rastreo de llamadas: | show_stack+0x18/0x24 (C) | dump_stack_lvl+0x78/0x90 | dump_stack+0x18/0x24 | __might_resched+0x114/0x170 | __might_sleep+0x48/0x98 | mutex_lock+0x24/0x80 | handle_notif_callbacks+0x54/0xe0 | notif_get_and_handle+0x40/0x88 | generic_exec_single+0x80/0xc0 | smp_call_function_single+0xfc/0x1a0 | notif_pcpu_irq_work_fn+0x2c/0x38 | process_one_work+0x14c/0x2b4 | work_thread+0x2e4/0x3e0 | kthread+0x13c/0x210 | ret_from_fork+0x10/0x20 Para solucionar esto, reemplace el mutex con un rwlock para proteger los accesos a la tabla hash del notificador. Esto garantiza que el bloqueo del lado de lectura no se suspenda y que varios lectores puedan adquirir el bloqueo simult\u00e1neamente, evitando contenciones innecesarias y posibles interbloqueos. El acceso de escritura se mantiene exclusivo, preservando la correcci\u00f3n. Este cambio resuelve las advertencias de lockdep sobre la posible suspensi\u00f3n en un contexto at\u00f3mico." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38389.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38389.json index 9a526666081..61f171aa255 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38389.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38389.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Fix timeline left held on VMA alloc error\n\nThe following error has been reported sporadically by CI when a test\nunbinds the i915 driver on a ring submission platform:\n\n<4> [239.330153] ------------[ cut here ]------------\n<4> [239.330166] i915 0000:00:02.0: [drm] drm_WARN_ON(dev_priv->mm.shrink_count)\n<4> [239.330196] WARNING: CPU: 1 PID: 18570 at drivers/gpu/drm/i915/i915_gem.c:1309 i915_gem_cleanup_early+0x13e/0x150 [i915]\n...\n<4> [239.330640] RIP: 0010:i915_gem_cleanup_early+0x13e/0x150 [i915]\n...\n<4> [239.330942] Call Trace:\n<4> [239.330944] \n<4> [239.330949] i915_driver_late_release+0x2b/0xa0 [i915]\n<4> [239.331202] i915_driver_release+0x86/0xa0 [i915]\n<4> [239.331482] devm_drm_dev_init_release+0x61/0x90\n<4> [239.331494] devm_action_release+0x15/0x30\n<4> [239.331504] release_nodes+0x3d/0x120\n<4> [239.331517] devres_release_all+0x96/0xd0\n<4> [239.331533] device_unbind_cleanup+0x12/0x80\n<4> [239.331543] device_release_driver_internal+0x23a/0x280\n<4> [239.331550] ? bus_find_device+0xa5/0xe0\n<4> [239.331563] device_driver_detach+0x14/0x20\n...\n<4> [357.719679] ---[ end trace 0000000000000000 ]---\n\nIf the test also unloads the i915 module then that's followed with:\n\n<3> [357.787478] =============================================================================\n<3> [357.788006] BUG i915_vma (Tainted: G U W N ): Objects remaining on __kmem_cache_shutdown()\n<3> [357.788031] -----------------------------------------------------------------------------\n<3> [357.788204] Object 0xffff888109e7f480 @offset=29824\n<3> [357.788670] Allocated in i915_vma_instance+0xee/0xc10 [i915] age=292729 cpu=4 pid=2244\n<4> [357.788994] i915_vma_instance+0xee/0xc10 [i915]\n<4> [357.789290] init_status_page+0x7b/0x420 [i915]\n<4> [357.789532] intel_engines_init+0x1d8/0x980 [i915]\n<4> [357.789772] intel_gt_init+0x175/0x450 [i915]\n<4> [357.790014] i915_gem_init+0x113/0x340 [i915]\n<4> [357.790281] i915_driver_probe+0x847/0xed0 [i915]\n<4> [357.790504] i915_pci_probe+0xe6/0x220 [i915]\n...\n\nCloser analysis of CI results history has revealed a dependency of the\nerror on a few IGT tests, namely:\n- igt@api_intel_allocator@fork-simple-stress-signal,\n- igt@api_intel_allocator@two-level-inception-interruptible,\n- igt@gem_linear_blits@interruptible,\n- igt@prime_mmap_coherency@ioctl-errors,\nwhich invisibly trigger the issue, then exhibited with first driver unbind\nattempt.\n\nAll of the above tests perform actions which are actively interrupted with\nsignals. Further debugging has allowed to narrow that scope down to\nDRM_IOCTL_I915_GEM_EXECBUFFER2, and ring_context_alloc(), specific to ring\nsubmission, in particular.\n\nIf successful then that function, or its execlists or GuC submission\nequivalent, is supposed to be called only once per GEM context engine,\nfollowed by raise of a flag that prevents the function from being called\nagain. The function is expected to unwind its internal errors itself, so\nit may be safely called once more after it returns an error.\n\nIn case of ring submission, the function first gets a reference to the\nengine's legacy timeline and then allocates a VMA. If the VMA allocation\nfails, e.g. when i915_vma_instance() called from inside is interrupted\nwith a signal, then ring_context_alloc() fails, leaving the timeline held\nreferenced. On next I915_GEM_EXECBUFFER2 IOCTL, another reference to the\ntimeline is got, and only that last one is put on successful completion.\nAs a consequence, the legacy timeline, with its underlying engine status\npage's VMA object, is still held and not released on driver unbind.\n\nGet the legacy timeline only after successful allocation of the context\nengine's VMA.\n\nv2: Add a note on other submission methods (Krzysztof Karas):\n Both execlists and GuC submission use lrc_alloc() which seems free\n from a similar issue.\n\n(cherry picked from commit cc43422b3cc79eacff4c5a8ba0d224688ca9dd4f)" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/i915/gt: Se corrige el error de l\u00ednea de tiempo retenida en la asignaci\u00f3n de VMA. CI ha informado espor\u00e1dicamente del siguiente error cuando una prueba desvincula el controlador i915 en una plataforma de env\u00edo de anillo: <4> [239.330153] ------------[ cut here ]------------ <4> [239.330166] i915 0000:00:02.0: [drm] drm_WARN_ON(dev_priv->mm.shrink_count) <4> [239.330196] WARNING: CPU: 1 PID: 18570 at drivers/gpu/drm/i915/i915_gem.c:1309 i915_gem_cleanup_early+0x13e/0x150 [i915] ... <4> [239.330640] RIP: 0010:i915_gem_cleanup_early+0x13e/0x150 [i915] ... <4> [239.330942] Call Trace: <4> [239.330944] <4> [239.330949] i915_driver_late_release+0x2b/0xa0 [i915] <4> [239.331202] i915_driver_release+0x86/0xa0 [i915] <4> [239.331482] devm_drm_dev_init_release+0x61/0x90 <4> [239.331494] devm_action_release+0x15/0x30 <4> [239.331504] release_nodes+0x3d/0x120 <4> [239.331517] devres_release_all+0x96/0xd0 <4> [239.331533] device_unbind_cleanup+0x12/0x80 <4> [239.331543] device_release_driver_internal+0x23a/0x280 <4> [239.331550] ? bus_find_device+0xa5/0xe0 <4> [239.331563] device_driver_detach+0x14/0x20 ... <4> [357.719679] ---[ end trace 0000000000000000 ]--- If the test also unloads the i915 module then that's followed with: <3> [357.787478] ============================================================================= <3> [357.788006] BUG i915_vma (Tainted: G U W N ): Objects remaining on __kmem_cache_shutdown() <3> [357.788031] ----------------------------------------------------------------------------- <3> [357.788204] Object 0xffff888109e7f480 @offset=29824 <3> [357.788670] Allocated in i915_vma_instance+0xee/0xc10 [i915] age=292729 cpu=4 pid=2244 <4> [357.788994] i915_vma_instance+0xee/0xc10 [i915] <4> [357.789290] init_status_page+0x7b/0x420 [i915] <4> [357.789532] intel_engines_init+0x1d8/0x980 [i915] <4> [357.789772] intel_gt_init+0x175/0x450 [i915] <4> ---truncado--- Un an\u00e1lisis m\u00e1s detallado del historial de resultados de CI ha revelado una dependencia del error en algunas pruebas IGT, a saber: - igt@api_intel_allocator@fork-simple-stress-signal, - igt@api_intel_allocator@two-level-inception-interruptible, - igt@gem_linear_blits@interruptible, - igt@prime_mmap_coherency@ioctl-errors, que activan el problema de forma invisible y se muestran con el primer intento de desvinculaci\u00f3n del controlador. Todas las pruebas anteriores realizan acciones que se interrumpen activamente con se\u00f1ales. Una depuraci\u00f3n posterior ha permitido limitar este alcance a DRM_IOCTL_I915_GEM_EXECBUFFER2 y ring_context_alloc(), espec\u00edficos para el env\u00edo de anillos. Si la ejecuci\u00f3n es correcta, se supone que esa funci\u00f3n, o sus execlists o equivalentes de env\u00edo de GuC, se llamar\u00e1 solo una vez por motor de contexto GEM, seguido de la activaci\u00f3n de un indicador que impide que se vuelva a llamar. Se espera que la funci\u00f3n corrija sus errores internos por s\u00ed misma, por lo que puede volver a llamarse de forma segura despu\u00e9s de devolver un error. En caso de env\u00edo de anillo, la funci\u00f3n primero obtiene una referencia a la l\u00ednea de tiempo heredada del motor y luego asigna un VMA. Si la asignaci\u00f3n del VMA falla, por ejemplo, cuando i915_vma_instance() llamado desde dentro se interrumpe con una se\u00f1al, entonces ring_context_alloc() falla, dejando la l\u00ednea de tiempo referenciada. En la siguiente IOCTL I915_GEM_EXECBUFFER2, se obtiene otra referencia a la l\u00ednea de tiempo, y solo esta \u00faltima se coloca al completarse correctamente. Como consecuencia, la l\u00ednea de tiempo heredada, con el objeto VMA de su p\u00e1gina de estado del motor subyacente, a\u00fan se mantiene y no se libera al desvincular el controlador. Obtenga la l\u00ednea de tiempo heredada solo despu\u00e9s de la asignaci\u00f3n exitosa del VMA del motor de contexto. v2: Agregar una nota sobre otros m\u00e9todos de env\u00edo (Krzysztof Karas): Tanto los execlists como el env\u00edo GuC usan lrc_alloc(), que parec" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38390.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38390.json index 98741e55e5b..a64169e6350 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38390.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38390.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Fix memory leak by freeing notifier callback node\n\nCommit e0573444edbf (\"firmware: arm_ffa: Add interfaces to request\nnotification callbacks\") adds support for notifier callbacks by allocating\nand inserting a callback node into a hashtable during registration of\nnotifiers. However, during unregistration, the code only removes the\nnode from the hashtable without freeing the associated memory, resulting\nin a memory leak.\n\nResolve the memory leak issue by ensuring the allocated notifier callback\nnode is properly freed after it is removed from the hashtable entry." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: arm_ffa: Corregir fuga de memoria liberando el nodo de devoluci\u00f3n de llamada del notificador. El commit e0573444edbf (\"firmware: arm_ffa: A\u00f1adir interfaces para solicitar devoluciones de llamada de notificaci\u00f3n\") a\u00f1ade compatibilidad con devoluciones de llamada de notificador mediante la asignaci\u00f3n e inserci\u00f3n de un nodo de devoluci\u00f3n de llamada en una tabla hash durante el registro de notificadores. Sin embargo, al anular el registro, el c\u00f3digo solo elimina el nodo de la tabla hash sin liberar la memoria asociada, lo que provoca una fuga de memoria. Para resolver el problema de fuga de memoria, aseg\u00farese de que el nodo de devoluci\u00f3n de llamada del notificador asignado se libere correctamente tras eliminarlo de la entrada de la tabla hash." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38391.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38391.json index 801d434f9ce..c7641607791 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38391.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38391.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: altmodes/displayport: do not index invalid pin_assignments\n\nA poorly implemented DisplayPort Alt Mode port partner can indicate\nthat its pin assignment capabilities are greater than the maximum\nvalue, DP_PIN_ASSIGN_F. In this case, calls to pin_assignment_show\nwill cause a BRK exception due to an out of bounds array access.\n\nPrevent for loop in pin_assignment_show from accessing\ninvalid values in pin_assignments by adding DP_PIN_ASSIGN_MAX\nvalue in typec_dp.h and using i < DP_PIN_ASSIGN_MAX as a loop\ncondition." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: typec: altmodes/displayport: no indexar asignaciones de pines no v\u00e1lidas. Un puerto asociado DisplayPort en modo alternativo mal implementado puede indicar que su capacidad de asignaci\u00f3n de pines supera el valor m\u00e1ximo, DP_PIN_ASSIGN_F. En este caso, las llamadas a pin_assignment_show provocar\u00e1n una excepci\u00f3n BRK debido a un acceso fuera de los l\u00edmites de la matriz. Para evitar que el bucle for de pin_assignment_show acceda a valores no v\u00e1lidos en las asignaciones de pines, agregue el valor DP_PIN_ASSIGN_MAX en typec_dp.h y use i < DP_PIN_ASSIGN_MAX como condici\u00f3n de bucle." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38392.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38392.json index dab7569e28b..10eff670f65 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38392.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38392.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: convert control queue mutex to a spinlock\n\nWith VIRTCHNL2_CAP_MACFILTER enabled, the following warning is generated\non module load:\n\n[ 324.701677] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578\n[ 324.701684] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1582, name: NetworkManager\n[ 324.701689] preempt_count: 201, expected: 0\n[ 324.701693] RCU nest depth: 0, expected: 0\n[ 324.701697] 2 locks held by NetworkManager/1582:\n[ 324.701702] #0: ffffffff9f7be770 (rtnl_mutex){....}-{3:3}, at: rtnl_newlink+0x791/0x21e0\n[ 324.701730] #1: ff1100216c380368 (_xmit_ETHER){....}-{2:2}, at: __dev_open+0x3f0/0x870\n[ 324.701749] Preemption disabled at:\n[ 324.701752] [] __dev_open+0x3dd/0x870\n[ 324.701765] CPU: 30 UID: 0 PID: 1582 Comm: NetworkManager Not tainted 6.15.0-rc5+ #2 PREEMPT(voluntary)\n[ 324.701771] Hardware name: Intel Corporation M50FCP2SBSTD/M50FCP2SBSTD, BIOS SE5C741.86B.01.01.0001.2211140926 11/14/2022\n[ 324.701774] Call Trace:\n[ 324.701777] \n[ 324.701779] dump_stack_lvl+0x5d/0x80\n[ 324.701788] ? __dev_open+0x3dd/0x870\n[ 324.701793] __might_resched.cold+0x1ef/0x23d\n<..>\n[ 324.701818] __mutex_lock+0x113/0x1b80\n<..>\n[ 324.701917] idpf_ctlq_clean_sq+0xad/0x4b0 [idpf]\n[ 324.701935] ? kasan_save_track+0x14/0x30\n[ 324.701941] idpf_mb_clean+0x143/0x380 [idpf]\n<..>\n[ 324.701991] idpf_send_mb_msg+0x111/0x720 [idpf]\n[ 324.702009] idpf_vc_xn_exec+0x4cc/0x990 [idpf]\n[ 324.702021] ? rcu_is_watching+0x12/0xc0\n[ 324.702035] idpf_add_del_mac_filters+0x3ed/0xb50 [idpf]\n<..>\n[ 324.702122] __hw_addr_sync_dev+0x1cf/0x300\n[ 324.702126] ? find_held_lock+0x32/0x90\n[ 324.702134] idpf_set_rx_mode+0x317/0x390 [idpf]\n[ 324.702152] __dev_open+0x3f8/0x870\n[ 324.702159] ? __pfx___dev_open+0x10/0x10\n[ 324.702174] __dev_change_flags+0x443/0x650\n<..>\n[ 324.702208] netif_change_flags+0x80/0x160\n[ 324.702218] do_setlink.isra.0+0x16a0/0x3960\n<..>\n[ 324.702349] rtnl_newlink+0x12fd/0x21e0\n\nThe sequence is as follows:\n\trtnl_newlink()->\n\t__dev_change_flags()->\n\t__dev_open()->\n\tdev_set_rx_mode() - > # disables BH and grabs \"dev->addr_list_lock\"\n\tidpf_set_rx_mode() -> # proceed only if VIRTCHNL2_CAP_MACFILTER is ON\n\t__dev_uc_sync() ->\n\tidpf_add_mac_filter ->\n\tidpf_add_del_mac_filters ->\n\tidpf_send_mb_msg() ->\n\tidpf_mb_clean() ->\n\tidpf_ctlq_clean_sq() # mutex_lock(cq_lock)\n\nFix by converting cq_lock to a spinlock. All operations under the new\nlock are safe except freeing the DMA memory, which may use vunmap(). Fix\nby requesting a contiguous physical memory for the DMA mapping." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: idpf: convertir mutex de cola de control en un spinlock Con VIRTCHNL2_CAP_MACFILTER habilitado, se genera la siguiente advertencia al cargar el m\u00f3dulo: [ 324.701677] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578 [ 324.701684] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1582, name: NetworkManager [ 324.701689] preempt_count: 201, expected: 0 [ 324.701693] RCU nest depth: 0, expected: 0 [ 324.701697] 2 locks held by NetworkManager/1582: [ 324.701702] #0: ffffffff9f7be770 (rtnl_mutex){....}-{3:3}, at: rtnl_newlink+0x791/0x21e0 [ 324.701730] #1: ff1100216c380368 (_xmit_ETHER){....}-{2:2}, at: __dev_open+0x3f0/0x870 [ 324.701749] Preemption disabled at: [ 324.701752] [] __dev_open+0x3dd/0x870 [ 324.701765] CPU: 30 UID: 0 PID: 1582 Comm: NetworkManager Not tainted 6.15.0-rc5+ #2 PREEMPT(voluntary) [ 324.701771] Hardware name: Intel Corporation M50FCP2SBSTD/M50FCP2SBSTD, BIOS SE5C741.86B.01.01.0001.2211140926 11/14/2022 [ 324.701774] Call Trace: [ 324.701777] [ 324.701779] dump_stack_lvl+0x5d/0x80 [ 324.701788] ? __dev_open+0x3dd/0x870 [ 324.701793] __might_resched.cold+0x1ef/0x23d <..> [ 324.701818] __mutex_lock+0x113/0x1b80 <..> [ 324.701917] idpf_ctlq_clean_sq+0xad/0x4b0 [idpf] [ 324.701935] ? kasan_save_track+0x14/0x30 [ 324.701941] idpf_mb_clean+0x143/0x380 [idpf] <..> [ 324.701991] idpf_send_mb_msg+0x111/0x720 [idpf] [ 324.702009] idpf_vc_xn_exec+0x4cc/0x990 [idpf] [ 324.702021] ? rcu_is_watching+0x12/0xc0 [ 324.702035] idpf_add_del_mac_filters+0x3ed/0xb50 [idpf] <..> [ 324.702122] __hw_addr_sync_dev+0x1cf/0x300 [ 324.702126] ? find_held_lock+0x32/0x90 [ 324.702134] idpf_set_rx_mode+0x317/0x390 [idpf] [ 324.702152] __dev_open+0x3f8/0x870 [ 324.702159] ? __pfx___dev_open+0x10/0x10 [ 324.702174] __dev_change_flags+0x443/0x650 <..> [ 324.702208] netif_change_flags+0x80/0x160 [ 324.702218] do_setlink.isra.0+0x16a0/0x3960 <..> [ 324.702349] rtnl_newlink+0x12fd/0x21e0 The sequence is as follows: rtnl_newlink()-> __dev_change_flags()-> __dev_open()-> dev_set_rx_mode() - > # disables BH and grabs \"dev->addr_list_lock\" idpf_set_rx_mode() -> # proceed only if VIRTCHNL2_CAP_MACFILTER is ON __dev_uc_sync() -> idpf_add_mac_filter -> idpf_add_del_mac_filters -> idpf_send_mb_msg() -> idpf_mb_clean() -> idpf_ctlq_clean_sq() # mutex_lock(cq_lock) Se corrige convirtiendo cq_lock en un bloqueo de giro. Todas las operaciones bajo el nuevo bloqueo son seguras, excepto la liberaci\u00f3n de memoria DMA, que puede usar vunmap(). Se corrige solicitando una memoria f\u00edsica contigua para la asignaci\u00f3n de DMA." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38393.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38393.json index d3712654996..fc630dc7829 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38393.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38393.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN\n\nWe found a few different systems hung up in writeback waiting on the same\npage lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in\npnfs_update_layout(), however the pnfs_layout_hdr's plh_outstanding count\nwas zero.\n\nIt seems most likely that this is another race between the waiter and waker\nsimilar to commit ed0172af5d6f (\"SUNRPC: Fix a race to wake a sync task\").\nFix it up by applying the advised barrier." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFSv4/pNFS: Correcci\u00f3n de una ejecuci\u00f3n para reactivar NFS_LAYOUT_DRAIN. Se encontraron varios sistemas bloqueados en espera de escritura diferida en el mismo bloqueo de p\u00e1gina, y una tarea esperando el bit NFS_LAYOUT_DRAIN en pnfs_update_layout(). Sin embargo, el recuento plh_outstanding de pnfs_layout_hdr era cero. Lo m\u00e1s probable es que se trate de otra ejecuci\u00f3n entre el que espera y el que reactiva, similar al commit ed0172af5d6f (\"SUNRPC: Correcci\u00f3n de una ejecuci\u00f3n para reactivar una tarea de sincronizaci\u00f3n\"). Se soluciona aplicando la barrera recomendada." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38394.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38394.json index f3dd0021a27..dfe882c00d1 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38394.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38394.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appletb-kbd: fix memory corruption of input_handler_list\n\nIn appletb_kbd_probe an input handler is initialised and then registered\nwith input core through input_register_handler(). When this happens input\ncore will add the input handler (specifically its node) to the global\ninput_handler_list. The input_handler_list is central to the functionality\nof input core and is traversed in various places in input core. An example\nof this is when a new input device is plugged in and gets registered with\ninput core.\n\nThe input_handler in probe is allocated as device managed memory. If a\nprobe failure occurs after input_register_handler() the input_handler\nmemory is freed, yet it will remain in the input_handler_list. This\neffectively means the input_handler_list contains a dangling pointer\nto data belonging to a freed input handler.\n\nThis causes an issue when any other input device is plugged in - in my\ncase I had an old PixArt HP USB optical mouse and I decided to\nplug it in after a failure occurred after input_register_handler().\nThis lead to the registration of this input device via\ninput_register_device which involves traversing over every handler\nin the corrupted input_handler_list and calling input_attach_handler(),\ngiving each handler a chance to bind to newly registered device.\n\nThe core of this bug is a UAF which causes memory corruption of\ninput_handler_list and to fix it we must ensure the input handler is\nunregistered from input core, this is done through\ninput_unregister_handler().\n\n[ 63.191597] ==================================================================\n[ 63.192094] BUG: KASAN: slab-use-after-free in input_attach_handler.isra.0+0x1a9/0x1e0\n[ 63.192094] Read of size 8 at addr ffff888105ea7c80 by task kworker/0:2/54\n[ 63.192094]\n[ 63.192094] CPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted 6.16.0-rc2-00321-g2aa6621d\n[ 63.192094] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.164\n[ 63.192094] Workqueue: usb_hub_wq hub_event\n[ 63.192094] Call Trace:\n[ 63.192094] \n[ 63.192094] dump_stack_lvl+0x53/0x70\n[ 63.192094] print_report+0xce/0x670\n[ 63.192094] kasan_report+0xce/0x100\n[ 63.192094] input_attach_handler.isra.0+0x1a9/0x1e0\n[ 63.192094] input_register_device+0x76c/0xd00\n[ 63.192094] hidinput_connect+0x686d/0xad60\n[ 63.192094] hid_connect+0xf20/0x1b10\n[ 63.192094] hid_hw_start+0x83/0x100\n[ 63.192094] hid_device_probe+0x2d1/0x680\n[ 63.192094] really_probe+0x1c3/0x690\n[ 63.192094] __driver_probe_device+0x247/0x300\n[ 63.192094] driver_probe_device+0x49/0x210\n[ 63.192094] __device_attach_driver+0x160/0x320\n[ 63.192094] bus_for_each_drv+0x10f/0x190\n[ 63.192094] __device_attach+0x18e/0x370\n[ 63.192094] bus_probe_device+0x123/0x170\n[ 63.192094] device_add+0xd4d/0x1460\n[ 63.192094] hid_add_device+0x30b/0x910\n[ 63.192094] usbhid_probe+0x920/0xe00\n[ 63.192094] usb_probe_interface+0x363/0x9a0\n[ 63.192094] really_probe+0x1c3/0x690\n[ 63.192094] __driver_probe_device+0x247/0x300\n[ 63.192094] driver_probe_device+0x49/0x210\n[ 63.192094] __device_attach_driver+0x160/0x320\n[ 63.192094] bus_for_each_drv+0x10f/0x190\n[ 63.192094] __device_attach+0x18e/0x370\n[ 63.192094] bus_probe_device+0x123/0x170\n[ 63.192094] device_add+0xd4d/0x1460\n[ 63.192094] usb_set_configuration+0xd14/0x1880\n[ 63.192094] usb_generic_driver_probe+0x78/0xb0\n[ 63.192094] usb_probe_device+0xaa/0x2e0\n[ 63.192094] really_probe+0x1c3/0x690\n[ 63.192094] __driver_probe_device+0x247/0x300\n[ 63.192094] driver_probe_device+0x49/0x210\n[ 63.192094] __device_attach_driver+0x160/0x320\n[ 63.192094] bus_for_each_drv+0x10f/0x190\n[ 63.192094] __device_attach+0x18e/0x370\n[ 63.192094] bus_probe_device+0x123/0x170\n[ 63.192094] device_add+0xd4d/0x1460\n[ 63.192094] usb_new_device+0x7b4/0x1000\n[ 63.192094] hub_event+0x234d/0x3\n---truncated---" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: HID: appletb-kbd: corrige la corrupci\u00f3n de memoria de input_handler_list En appletb_kbd_probe se inicializa un manejador de entrada y luego se registra con el n\u00facleo de entrada a trav\u00e9s de input_register_handler(). Cuando esto sucede, el n\u00facleo de entrada agregar\u00e1 el manejador de entrada (espec\u00edficamente su nodo) a la input_handler_list global. La input_handler_list es central para la funcionalidad del n\u00facleo de entrada y se recorre en varios lugares del n\u00facleo de entrada. Un ejemplo de esto es cuando se conecta un nuevo dispositivo de entrada y se registra con el n\u00facleo de entrada. El input_handler en la sonda se asigna como memoria administrada por el dispositivo. Si ocurre un fallo de la sonda despu\u00e9s de input_register_handler(), la memoria del input_handler se libera, pero permanecer\u00e1 en la input_handler_list. Esto significa efectivamente que la input_handler_list contiene un puntero colgante a los datos que pertenecen a un manejador de entrada liberado. Esto causa un problema al conectar cualquier otro dispositivo de entrada. En mi caso, ten\u00eda un rat\u00f3n \u00f3ptico USB PixArt HP antiguo y decid\u00ed conectarlo tras un fallo despu\u00e9s de la funci\u00f3n input_register_handler(). Esto provoc\u00f3 el registro de este dispositivo de entrada mediante input_register_device, lo que implica recorrer cada controlador de la lista de controladores de entrada corrupta y llamar a input_attach_handler(), lo que permite a cada controlador vincularse al nuevo dispositivo registrado. El problema principal es un UAF que causa corrupci\u00f3n de memoria en la lista de controladores de entrada. Para solucionarlo, debemos asegurarnos de que el controlador de entrada no est\u00e9 registrado en el n\u00facleo de entrada. Esto se realiza mediante input_unregister_handler(). [ 63.191597] ================================================================== [ 63.192094] BUG: KASAN: slab-use-after-free in input_attach_handler.isra.0+0x1a9/0x1e0 [ 63.192094] Read of size 8 at addr ffff888105ea7c80 by task kworker/0:2/54 [ 63.192094] [ 63.192094] CPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted 6.16.0-rc2-00321-g2aa6621d [ 63.192094] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.164 [ 63.192094] Workqueue: usb_hub_wq hub_event [ 63.192094] Call Trace: [ 63.192094] [ 63.192094] dump_stack_lvl+0x53/0x70 [ 63.192094] print_report+0xce/0x670 [ 63.192094] kasan_report+0xce/0x100 [ 63.192094] input_attach_handler.isra.0+0x1a9/0x1e0 [ 63.192094] input_register_device+0x76c/0xd00 [ 63.192094] hidinput_connect+0x686d/0xad60 [ 63.192094] hid_connect+0xf20/0x1b10 [ 63.192094] hid_hw_start+0x83/0x100 [ 63.192094] hid_device_probe+0x2d1/0x680 [ 63.192094] really_probe+0x1c3/0x690 [ 63.192094] __driver_probe_device+0x247/0x300 [ 63.192094] driver_probe_device+0x49/0x210 [ 63.192094] __device_attach_driver+0x160/0x320 [ 63.192094] bus_for_each_drv+0x10f/0x190 [ 63.192094] __device_attach+0x18e/0x370 [ 63.192094] bus_probe_device+0x123/0x170 [ 63.192094] device_add+0xd4d/0x1460 [ 63.192094] hid_add_device+0x30b/0x910 [ 63.192094] usbhid_probe+0x920/0xe00 [ 63.192094] usb_probe_interface+0x363/0x9a0 [ 63.192094] really_probe+0x1c3/0x690 [ 63.192094] __driver_probe_device+0x247/0x300 [ 63.192094] driver_probe_device+0x49/0x210 [ 63.192094] __device_attach_driver+0x160/0x320 [ 63.192094] bus_for_each_drv+0x10f/0x190 [ 63.192094] __device_attach+0x18e/0x370 [ 63.192094] bus_probe_device+0x123/0x170 [ 63.192094] device_add+0xd4d/0x1460 [ 63.192094] usb_set_configuration+0xd14/0x1880 [ 63.192094] usb_generic_driver_probe+0x78/0xb0 [ 63.192094] usb_probe_device+0xaa/0x2e0 [ 63.192094] really_probe+0x1c3/0x690 [ 63.192094] __driver_probe_device+0x247/0x300 [ 63.192094] driver_probe_device+0x49/0x210 ---truncado---" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38395.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38395.json index cb115663ecd..a0b4c1a701b 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38395.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38395.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: gpio: Fix the out-of-bounds access to drvdata::gpiods\n\ndrvdata::gpiods is supposed to hold an array of 'gpio_desc' pointers. But\nthe memory is allocated for only one pointer. This will lead to\nout-of-bounds access later in the code if 'config::ngpios' is > 1. So\nfix the code to allocate enough memory to hold 'config::ngpios' of GPIO\ndescriptors.\n\nWhile at it, also move the check for memory allocation failure to be below\nthe allocation to make it more readable." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: regulator: gpio: Se corrige el acceso fuera de los l\u00edmites a drvdata::gpiods. drvdata::gpiods debe contener una matriz de punteros 'gpio_desc'. Sin embargo, la memoria solo est\u00e1 asignada a un puntero. Esto provocar\u00e1 un acceso fuera de los l\u00edmites m\u00e1s adelante en el c\u00f3digo si 'config::ngpios' es > 1. Por lo tanto, corrija el c\u00f3digo para asignar suficiente memoria para contener 'config::ngpios' de descriptores GPIO. Adem\u00e1s, mueva la comprobaci\u00f3n de fallos de asignaci\u00f3n de memoria a un valor inferior a la asignaci\u00f3n para que sea m\u00e1s legible." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38396.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38396.json index 182e98c1b49..a96a76d3ec7 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38396.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38396.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass\n\nExport anon_inode_make_secure_inode() to allow KVM guest_memfd to create\nanonymous inodes with proper security context. This replaces the current\npattern of calling alloc_anon_inode() followed by\ninode_init_security_anon() for creating security context manually.\n\nThis change also fixes a security regression in secretmem where the\nS_PRIVATE flag was not cleared after alloc_anon_inode(), causing\nLSM/SELinux checks to be bypassed for secretmem file descriptors.\n\nAs guest_memfd currently resides in the KVM module, we need to export this\nsymbol for use outside the core kernel. In the future, guest_memfd might be\nmoved to core-mm, at which point the symbols no longer would have to be\nexported. When/if that happens is still unclear." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs: exportar anon_inode_make_secure_inode() y corregir la omisi\u00f3n de LSM de secretmem Exportar anon_inode_make_secure_inode() para permitir que KVM guest_memfd cree inodos an\u00f3nimos con el contexto de seguridad adecuado. Esto reemplaza el patr\u00f3n actual de llamar a alloc_anon_inode() seguido de inode_init_security_anon() para crear el contexto de seguridad manualmente. Este cambio tambi\u00e9n corrige una regresi\u00f3n de seguridad en secretmem donde el indicador S_PRIVATE no se borr\u00f3 despu\u00e9s de alloc_anon_inode(), lo que provoc\u00f3 que se omitieran las comprobaciones de LSM/SELinux para los descriptores de archivos de secretmem. Como guest_memfd reside actualmente en el m\u00f3dulo KVM, necesitamos exportar este s\u00edmbolo para su uso fuera del n\u00facleo del kernel. En el futuro, guest_memfd podr\u00eda moverse a core-mm, en cuyo punto los s\u00edmbolos ya no tendr\u00edan que exportarse. Cu\u00e1ndo/si eso sucede a\u00fan no est\u00e1 claro." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38397.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38397.json index 4660d21d04c..99b569a09ba 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38397.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38397.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: fix suspicious RCU usage warning\n\nWhen I run the NVME over TCP test in virtme-ng, I get the following\n\"suspicious RCU usage\" warning in nvme_mpath_add_sysfs_link():\n\n'''\n[ 5.024557][ T44] nvmet: Created nvm controller 1 for subsystem nqn.2025-06.org.nvmexpress.mptcp for NQN nqn.2014-08.org.nvmexpress:uuid:f7f6b5e0-ff97-4894-98ac-c85309e0bc77.\n[ 5.027401][ T183] nvme nvme0: creating 2 I/O queues.\n[ 5.029017][ T183] nvme nvme0: mapped 2/0/0 default/read/poll queues.\n[ 5.032587][ T183] nvme nvme0: new ctrl: NQN \"nqn.2025-06.org.nvmexpress.mptcp\", addr 127.0.0.1:4420, hostnqn: nqn.2014-08.org.nvmexpress:uuid:f7f6b5e0-ff97-4894-98ac-c85309e0bc77\n[ 5.042214][ T25]\n[ 5.042440][ T25] =============================\n[ 5.042579][ T25] WARNING: suspicious RCU usage\n[ 5.042705][ T25] 6.16.0-rc3+ #23 Not tainted\n[ 5.042812][ T25] -----------------------------\n[ 5.042934][ T25] drivers/nvme/host/multipath.c:1203 RCU-list traversed in non-reader section!!\n[ 5.043111][ T25]\n[ 5.043111][ T25] other info that might help us debug this:\n[ 5.043111][ T25]\n[ 5.043341][ T25]\n[ 5.043341][ T25] rcu_scheduler_active = 2, debug_locks = 1\n[ 5.043502][ T25] 3 locks held by kworker/u9:0/25:\n[ 5.043615][ T25] #0: ffff888008730948 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x7ed/0x1350\n[ 5.043830][ T25] #1: ffffc900001afd40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0xcf3/0x1350\n[ 5.044084][ T25] #2: ffff888013ee0020 (&head->srcu){.+.+}-{0:0}, at: nvme_mpath_add_sysfs_link.part.0+0xb4/0x3a0\n[ 5.044300][ T25]\n[ 5.044300][ T25] stack backtrace:\n[ 5.044439][ T25] CPU: 0 UID: 0 PID: 25 Comm: kworker/u9:0 Not tainted 6.16.0-rc3+ #23 PREEMPT(full)\n[ 5.044441][ T25] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 5.044442][ T25] Workqueue: async async_run_entry_fn\n[ 5.044445][ T25] Call Trace:\n[ 5.044446][ T25] \n[ 5.044449][ T25] dump_stack_lvl+0x6f/0xb0\n[ 5.044453][ T25] lockdep_rcu_suspicious.cold+0x4f/0xb1\n[ 5.044457][ T25] nvme_mpath_add_sysfs_link.part.0+0x2fb/0x3a0\n[ 5.044459][ T25] ? queue_work_on+0x90/0xf0\n[ 5.044461][ T25] ? lockdep_hardirqs_on+0x78/0x110\n[ 5.044466][ T25] nvme_mpath_set_live+0x1e9/0x4f0\n[ 5.044470][ T25] nvme_mpath_add_disk+0x240/0x2f0\n[ 5.044472][ T25] ? __pfx_nvme_mpath_add_disk+0x10/0x10\n[ 5.044475][ T25] ? add_disk_fwnode+0x361/0x580\n[ 5.044480][ T25] nvme_alloc_ns+0x81c/0x17c0\n[ 5.044483][ T25] ? kasan_quarantine_put+0x104/0x240\n[ 5.044487][ T25] ? __pfx_nvme_alloc_ns+0x10/0x10\n[ 5.044495][ T25] ? __pfx_nvme_find_get_ns+0x10/0x10\n[ 5.044496][ T25] ? rcu_read_lock_any_held+0x45/0xa0\n[ 5.044498][ T25] ? validate_chain+0x232/0x4f0\n[ 5.044503][ T25] nvme_scan_ns+0x4c8/0x810\n[ 5.044506][ T25] ? __pfx_nvme_scan_ns+0x10/0x10\n[ 5.044508][ T25] ? find_held_lock+0x2b/0x80\n[ 5.044512][ T25] ? ktime_get+0x16d/0x220\n[ 5.044517][ T25] ? kvm_clock_get_cycles+0x18/0x30\n[ 5.044520][ T25] ? __pfx_nvme_scan_ns_async+0x10/0x10\n[ 5.044522][ T25] async_run_entry_fn+0x97/0x560\n[ 5.044523][ T25] ? rcu_is_watching+0x12/0xc0\n[ 5.044526][ T25] process_one_work+0xd3c/0x1350\n[ 5.044532][ T25] ? __pfx_process_one_work+0x10/0x10\n[ 5.044536][ T25] ? assign_work+0x16c/0x240\n[ 5.044539][ T25] worker_thread+0x4da/0xd50\n[ 5.044545][ T25] ? __pfx_worker_thread+0x10/0x10\n[ 5.044546][ T25] kthread+0x356/0x5c0\n[ 5.044548][ T25] ? __pfx_kthread+0x10/0x10\n[ 5.044549][ T25] ? ret_from_fork+0x1b/0x2e0\n[ 5.044552][ T25] ? __lock_release.isra.0+0x5d/0x180\n[ 5.044553][ T25] ? ret_from_fork+0x1b/0x2e0\n[ 5.044555][ T25] ? rcu_is_watching+0x12/0xc0\n[ 5.044557][ T25] ? __pfx_kthread+0x10/0x10\n[ 5.04\n---truncated---" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme-multipath: corregir advertencia de uso sospechoso de RCU Cuando ejecuto la prueba NVME sobre TCP en virtme-ng, obtengo la siguiente advertencia de \"uso sospechoso de RCU\" en nvme_mpath_add_sysfs_link(): ''' [ 5.024557][ T44] nvmet: Created nvm controller 1 for subsystem nqn.2025-06.org.nvmexpress.mptcp for NQN nqn.2014-08.org.nvmexpress:uuid:f7f6b5e0-ff97-4894-98ac-c85309e0bc77. [ 5.027401][ T183] nvme nvme0: creating 2 I/O queues. [ 5.029017][ T183] nvme nvme0: mapped 2/0/0 default/read/poll queues. [ 5.032587][ T183] nvme nvme0: new ctrl: NQN \"nqn.2025-06.org.nvmexpress.mptcp\", addr 127.0.0.1:4420, hostnqn: nqn.2014-08.org.nvmexpress:uuid:f7f6b5e0-ff97-4894-98ac-c85309e0bc77 [ 5.042214][ T25] [ 5.042440][ T25] ============================= [ 5.042579][ T25] WARNING: suspicious RCU usage [ 5.042705][ T25] 6.16.0-rc3+ #23 Not tainted [ 5.042812][ T25] ----------------------------- [ 5.042934][ T25] drivers/nvme/host/multipath.c:1203 RCU-list traversed in non-reader section!! [ 5.043111][ T25] [ 5.043111][ T25] other info that might help us debug this: [ 5.043111][ T25] [ 5.043341][ T25] [ 5.043341][ T25] rcu_scheduler_active = 2, debug_locks = 1 [ 5.043502][ T25] 3 locks held by kworker/u9:0/25: [ 5.043615][ T25] #0: ffff888008730948 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x7ed/0x1350 [ 5.043830][ T25] #1: ffffc900001afd40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0xcf3/0x1350 [ 5.044084][ T25] #2: ffff888013ee0020 (&head->srcu){.+.+}-{0:0}, at: nvme_mpath_add_sysfs_link.part.0+0xb4/0x3a0 [ 5.044300][ T25] [ 5.044300][ T25] stack backtrace: [ 5.044439][ T25] CPU: 0 UID: 0 PID: 25 Comm: kworker/u9:0 Not tainted 6.16.0-rc3+ #23 PREEMPT(full) [ 5.044441][ T25] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 5.044442][ T25] Workqueue: async async_run_entry_fn [ 5.044445][ T25] Call Trace: [ 5.044446][ T25] [ 5.044449][ T25] dump_stack_lvl+0x6f/0xb0 [ 5.044453][ T25] lockdep_rcu_suspicious.cold+0x4f/0xb1 [ 5.044457][ T25] nvme_mpath_add_sysfs_link.part.0+0x2fb/0x3a0 [ 5.044459][ T25] ? queue_work_on+0x90/0xf0 [ 5.044461][ T25] ? lockdep_hardirqs_on+0x78/0x110 [ 5.044466][ T25] nvme_mpath_set_live+0x1e9/0x4f0 [ 5.044470][ T25] nvme_mpath_add_disk+0x240/0x2f0 [ 5.044472][ T25] ? __pfx_nvme_mpath_add_disk+0x10/0x10 [ 5.044475][ T25] ? add_disk_fwnode+0x361/0x580 [ 5.044480][ T25] nvme_alloc_ns+0x81c/0x17c0 [ 5.044483][ T25] ? kasan_quarantine_put+0x104/0x240 [ 5.044487][ T25] ? __pfx_nvme_alloc_ns+0x10/0x10 [ 5.044495][ T25] ? __pfx_nvme_find_get_ns+0x10/0x10 [ 5.044496][ T25] ? rcu_read_lock_any_held+0x45/0xa0 [ 5.044498][ T25] ? validate_chain+0x232/0x4f0 [ 5.044503][ T25] nvme_scan_ns+0x4c8/0x810 [ 5.044506][ T25] ? __pfx_nvme_scan_ns+0x10/0x10 [ 5.044508][ T25] ? find_held_lock+0x2b/0x80 [ 5.044512][ T25] ? ktime_get+0x16d/0x220 [ 5.044517][ T25] ? kvm_clock_get_cycles+0x18/0x30 [ 5.044520][ T25] ? __pfx_nvme_scan_ns_async+0x10/0x10 [ 5.044522][ T25] async_run_entry_fn+0x97/0x560 [ 5.044523][ T25] ? rcu_is_watching+0x12/0xc0 [ 5.044526][ T25] process_one_work+0xd3c/0x1350 [ 5.044532][ T25] ? __pfx_process_one_work+0x10/0x10 [ 5.044536][ T25] ? assign_work+0x16c/0x240 [ 5.044539][ T25] worker_thread+0x4da/0xd50 [ 5.044545][ T25] ? __pfx_worker_thread+0x10/0x10 [ 5.044546][ T25] kthread+0x356/0x5c0 [ 5.044548][ T25] ? __pfx_kthread+0x10/0x10 [ 5.044549][ T25] ? ret_from_fork+0x1b/0x2e0 [ 5.044552][ T25] ? __lock_release.isra.0+0x5d/0x180 [ 5.044553][ T25] ? ret_from_fork+0x1b/0x2e0 [ 5.044555][ T25] ? rcu_is_watching+0x12/0xc0 [ 5.044557][ T25] ? __pfx_kthread+0x10/0x10 [ 5.04 ---truncated---" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38398.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38398.json index 83c1dbe4cdb..1ac3f8c8690 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38398.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38398.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-qpic-snand: reallocate BAM transactions\n\nUsing the mtd_nandbiterrs module for testing the driver occasionally\nresults in weird things like below.\n\n1. swiotlb mapping fails with the following message:\n\n [ 85.926216] qcom_snand 79b0000.spi: swiotlb buffer is full (sz: 4294967294 bytes), total 512 (slots), used 0 (slots)\n [ 85.932937] qcom_snand 79b0000.spi: failure in mapping desc\n [ 87.999314] qcom_snand 79b0000.spi: failure to write raw page\n [ 87.999352] mtd_nandbiterrs: error: write_oob failed (-110)\n\n Rebooting the board after this causes a panic due to a NULL pointer\n dereference.\n\n2. If the swiotlb mapping does not fail, rebooting the board may result\n in a different panic due to a bad spinlock magic:\n\n [ 256.104459] BUG: spinlock bad magic on CPU#3, procd/2241\n [ 256.104488] Unable to handle kernel paging request at virtual address ffffffff0000049b\n ...\n\nInvestigating the issue revealed that these symptoms are results of\nmemory corruption which is caused by out of bounds access within the\ndriver.\n\nThe driver uses a dynamically allocated structure for BAM transactions,\nwhich structure must have enough space for all possible variations of\ndifferent flash operations initiated by the driver. The required space\nheavily depends on the actual number of 'codewords' which is calculated\nfrom the pagesize of the actual NAND chip.\n\nAlthough the qcom_nandc_alloc() function allocates memory for the BAM\ntransactions during probe, but since the actual number of 'codewords'\nis not yet know the allocation is done for one 'codeword' only.\n\nBecause of this, whenever the driver does a flash operation, and the\nnumber of the required transactions exceeds the size of the allocated\narrays the driver accesses memory out of the allocated range.\n\nTo avoid this, change the code to free the initially allocated BAM\ntransactions memory, and allocate a new one once the actual number of\n'codewords' required for a given NAND chip is known." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spi: spi-qpic-snand: reasignar transacciones BAM El uso del m\u00f3dulo mtd_nandbiterrs para probar el controlador ocasionalmente da como resultado cosas extra\u00f1as como la siguiente. 1. La asignaci\u00f3n de swiotlb falla con el siguiente mensaje: [85.926216] qcom_snand 79b0000.spi: el b\u00fafer de swiotlb est\u00e1 lleno (sz: 4294967294 bytes), total 512 (ranuras), usado 0 (ranuras) [85.932937] qcom_snand 79b0000.spi: error en la asignaci\u00f3n desc [87.999314] qcom_snand 79b0000.spi: error al escribir la p\u00e1gina sin formato [87.999352] mtd_nandbiterrs: error: write_oob fall\u00f3 (-110) Reiniciar la placa despu\u00e9s de esto provoca un p\u00e1nico debido a una desreferencia de puntero NULL. 2. Si el mapeo swiotlb no falla, reiniciar la placa puede resultar en un p\u00e1nico diferente debido a un spinlock magic defectuoso: [ 256.104459] BUG: spinlock bad magic on CPU#3, procd/2241 [ 256.104488] Unable to handle kernel paging request at virtual address ffffffff0000049b ... La investigaci\u00f3n del problema revel\u00f3 que estos s\u00edntomas son resultados de la corrupci\u00f3n de memoria que es causada por el acceso fuera de los l\u00edmites dentro del controlador. El controlador utiliza una estructura asignada din\u00e1micamente para las transacciones BAM, dicha estructura debe tener suficiente espacio para todas las posibles variaciones de diferentes operaciones flash iniciadas por el controlador. El espacio requerido depende en gran medida del n\u00famero real de 'palabras de c\u00f3digo' que se calcula a partir del tama\u00f1o de p\u00e1gina del chip NAND real. Aunque la funci\u00f3n qcom_nandc_alloc() asigna memoria para las transacciones BAM durante el sondeo, pero como el n\u00famero real de 'palabras de c\u00f3digo' a\u00fan no se conoce, la asignaci\u00f3n se realiza solo para una 'palabra de c\u00f3digo'. Por ello, siempre que el controlador realiza una operaci\u00f3n de flash y el n\u00famero de transacciones requeridas excede el tama\u00f1o de las matrices asignadas, accede a memoria fuera del rango asignado. Para evitarlo, modifique el c\u00f3digo para liberar la memoria de transacciones BAM inicialmente asignada y asigne una nueva una vez que se conozca el n\u00famero real de palabras de c\u00f3digo requeridas para un chip NAND determinado." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-383xx/CVE-2025-38399.json b/CVE-2025/CVE-2025-383xx/CVE-2025-38399.json index 1a6ac116d9b..9e1c2a989f2 100644 --- a/CVE-2025/CVE-2025-383xx/CVE-2025-38399.json +++ b/CVE-2025/CVE-2025-383xx/CVE-2025-38399.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()\n\nThe function core_scsi3_decode_spec_i_port(), in its error code path,\nunconditionally calls core_scsi3_lunacl_undepend_item() passing the\ndest_se_deve pointer, which may be NULL.\n\nThis can lead to a NULL pointer dereference if dest_se_deve remains\nunset.\n\nSPC-3 PR SPEC_I_PT: Unable to locate dest_tpg\nUnable to handle kernel paging request at virtual address dfff800000000012\nCall trace:\n core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P)\n core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod]\n core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod]\n target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod]\n\nFix this by adding a NULL check before calling\ncore_scsi3_lunacl_undepend_item()" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port(). La funci\u00f3n core_scsi3_decode_spec_i_port(), en su ruta de c\u00f3digo de error, llama incondicionalmente a core_scsi3_lunacl_undepend_item() pasando el puntero dest_se_deve, que puede ser NULL. Esto puede provocar una desreferencia de puntero NULL si dest_se_deve permanece sin definir. SPC-3 PR SPEC_I_PT: No se puede ubicar dest_tpg No se puede manejar la solicitud de paginaci\u00f3n del n\u00facleo en la direcci\u00f3n virtual dfff800000000012 Rastreo de llamadas: core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P) core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod] core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod] target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod] Solucione esto agregando una comprobaci\u00f3n NULL antes de llamar a core_scsi3_lunacl_undepend_item()" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38400.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38400.json index 8dc0cf0db58..b720eede802 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38400.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38400.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.\n\nsyzbot reported a warning below [1] following a fault injection in\nnfs_fs_proc_net_init(). [0]\n\nWhen nfs_fs_proc_net_init() fails, /proc/net/rpc/nfs is not removed.\n\nLater, rpc_proc_exit() tries to remove /proc/net/rpc, and the warning\nis logged as the directory is not empty.\n\nLet's handle the error of nfs_fs_proc_net_init() properly.\n\n[0]:\nFAULT_INJECTION: forcing a failure.\nname failslab, interval 1, probability 0, space 0, times 0\nCPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nCall Trace:\n \n dump_stack_lvl (lib/dump_stack.c:123)\n should_fail_ex (lib/fault-inject.c:73 lib/fault-inject.c:174)\n should_failslab (mm/failslab.c:46)\n kmem_cache_alloc_noprof (mm/slub.c:4178 mm/slub.c:4204)\n __proc_create (fs/proc/generic.c:427)\n proc_create_reg (fs/proc/generic.c:554)\n proc_create_net_data (fs/proc/proc_net.c:120)\n nfs_fs_proc_net_init (fs/nfs/client.c:1409)\n nfs_net_init (fs/nfs/inode.c:2600)\n ops_init (net/core/net_namespace.c:138)\n setup_net (net/core/net_namespace.c:443)\n copy_net_ns (net/core/net_namespace.c:576)\n create_new_namespaces (kernel/nsproxy.c:110)\n unshare_nsproxy_namespaces (kernel/nsproxy.c:218 (discriminator 4))\n ksys_unshare (kernel/fork.c:3123)\n __x64_sys_unshare (kernel/fork.c:3190)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \n\n[1]:\nremove_proc_entry: removing non-empty directory 'net/rpc', leaking at least 'nfs'\n WARNING: CPU: 1 PID: 6120 at fs/proc/generic.c:727 remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727\nModules linked in:\nCPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\n RIP: 0010:remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727\nCode: 3c 02 00 0f 85 85 00 00 00 48 8b 93 d8 00 00 00 4d 89 f0 4c 89 e9 48 c7 c6 40 ba a2 8b 48 c7 c7 60 b9 a2 8b e8 33 81 1d ff 90 <0f> 0b 90 90 e9 5f fe ff ff e8 04 69 5e ff 90 48 b8 00 00 00 00 00\nRSP: 0018:ffffc90003637b08 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: ffff88805f534140 RCX: ffffffff817a92c8\nRDX: ffff88807da99e00 RSI: ffffffff817a92d5 RDI: 0000000000000001\nRBP: ffff888033431ac0 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000001 R12: ffff888033431a00\nR13: ffff888033431ae4 R14: ffff888033184724 R15: dffffc0000000000\nFS: 0000555580328500(0000) GS:ffff888124a62000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f71733743e0 CR3: 000000007f618000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n sunrpc_exit_net+0x46/0x90 net/sunrpc/sunrpc_syms.c:76\n ops_exit_list net/core/net_namespace.c:200 [inline]\n ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253\n setup_net+0x2e1/0x510 net/core/net_namespace.c:457\n copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:574\n create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110\n unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218\n ksys_unshare+0x45b/0xa40 kernel/fork.c:3121\n __do_sys_unshare kernel/fork.c:3192 [inline]\n __se_sys_unshare kernel/fork.c:3190 [inline]\n __x64_sys_unshare+0x31/0x40 kernel/fork.c:3190\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fa1a6b8e929\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c\n---truncated---" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfs: Se elimina /proc/net/rpc/nfs cuando falla nfs_fs_proc_net_init(). syzbot report\u00f3 la siguiente advertencia [1] tras una inyecci\u00f3n de fallo en nfs_fs_proc_net_init(). [0] Cuando nfs_fs_proc_net_init() falla, no se elimina /proc/net/rpc/nfs. Posteriormente, rpc_proc_exit() intenta eliminar /proc/net/rpc y la advertencia se registra porque el directorio no est\u00e1 vac\u00edo. Abordemos el error de nfs_fs_proc_net_init() correctamente.[0]: FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl (lib/dump_stack.c:123) should_fail_ex (lib/fault-inject.c:73 lib/fault-inject.c:174) should_failslab (mm/failslab.c:46) kmem_cache_alloc_noprof (mm/slub.c:4178 mm/slub.c:4204) __proc_create (fs/proc/generic.c:427) proc_create_reg (fs/proc/generic.c:554) proc_create_net_data (fs/proc/proc_net.c:120) nfs_fs_proc_net_init (fs/nfs/client.c:1409) nfs_net_init (fs/nfs/inode.c:2600) ops_init (net/core/net_namespace.c:138) setup_net (net/core/net_namespace.c:443) copy_net_ns (net/core/net_namespace.c:576) create_new_namespaces (kernel/nsproxy.c:110) unshare_nsproxy_namespaces (kernel/nsproxy.c:218 (discriminator 4)) ksys_unshare (kernel/fork.c:3123) __x64_sys_unshare (kernel/fork.c:3190) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [1]: remove_proc_entry: removing non-empty directory 'net/rpc', leaking at least 'nfs' WARNING: CPU: 1 PID: 6120 at fs/proc/generic.c:727 remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Modules linked in: CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Code: 3c 02 00 0f 85 85 00 00 00 48 8b 93 d8 00 00 00 4d 89 f0 4c 89 e9 48 c7 c6 40 ba a2 8b 48 c7 c7 60 b9 a2 8b e8 33 81 1d ff 90 <0f> 0b 90 90 e9 5f fe ff ff e8 04 69 5e ff 90 48 b8 00 00 00 00 00 RSP: 0018:ffffc90003637b08 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88805f534140 RCX: ffffffff817a92c8 RDX: ffff88807da99e00 RSI: ffffffff817a92d5 RDI: 0000000000000001 RBP: ffff888033431ac0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff888033431a00 R13: ffff888033431ae4 R14: ffff888033184724 R15: dffffc0000000000 FS: 0000555580328500(0000) GS:ffff888124a62000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f71733743e0 CR3: 000000007f618000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: sunrpc_exit_net+0x46/0x90 net/sunrpc/sunrpc_syms.c:76 ops_exit_list net/core/net_namespace.c:200 [inline] ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253 setup_net+0x2e1/0x510 net/core/net_namespace.c:457 copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:574 create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218 ksys_unshare+0x45b/0xa40 kernel/fork.c:3121 __do_sys_unshare kernel/fork.c:3192 [inline] __se_sys_unshare kernel/fork.c:3190 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3190 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa1a6b8e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c ---truncated---" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38401.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38401.json index f589fa7d64b..03351826142 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38401.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38401.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtk-sd: Prevent memory corruption from DMA map failure\n\nIf msdc_prepare_data() fails to map the DMA region, the request is\nnot prepared for data receiving, but msdc_start_data() proceeds\nthe DMA with previous setting.\nSince this will lead a memory corruption, we have to stop the\nrequest operation soon after the msdc_prepare_data() fails to\nprepare it." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mtk-sd: Prevenir la corrupci\u00f3n de memoria por un fallo en el mapeo de DMA. Si msdc_prepare_data() no logra mapear la regi\u00f3n DMA, la solicitud no se prepara para la recepci\u00f3n de datos, pero msdc_start_data() contin\u00faa el DMA con la configuraci\u00f3n anterior. Dado que esto provocar\u00e1 una corrupci\u00f3n de memoria, debemos detener la solicitud poco despu\u00e9s de que msdc_prepare_data() no la prepare." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38402.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38402.json index 715134a5bc5..1c2d7f5e5e5 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38402.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38402.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: return 0 size for RSS key if not supported\n\nReturning -EOPNOTSUPP from function returning u32 is leading to\ncast and invalid size value as a result.\n\n-EOPNOTSUPP as a size probably will lead to allocation fail.\n\nCommand: ethtool -x eth0\nIt is visible on all devices that don't have RSS caps set.\n\n[ 136.615917] Call Trace:\n[ 136.615921] \n[ 136.615927] ? __warn+0x89/0x130\n[ 136.615942] ? __alloc_frozen_pages_noprof+0x322/0x330\n[ 136.615953] ? report_bug+0x164/0x190\n[ 136.615968] ? handle_bug+0x58/0x90\n[ 136.615979] ? exc_invalid_op+0x17/0x70\n[ 136.615987] ? asm_exc_invalid_op+0x1a/0x20\n[ 136.616001] ? rss_prepare_get.constprop.0+0xb9/0x170\n[ 136.616016] ? __alloc_frozen_pages_noprof+0x322/0x330\n[ 136.616028] __alloc_pages_noprof+0xe/0x20\n[ 136.616038] ___kmalloc_large_node+0x80/0x110\n[ 136.616072] __kmalloc_large_node_noprof+0x1d/0xa0\n[ 136.616081] __kmalloc_noprof+0x32c/0x4c0\n[ 136.616098] ? rss_prepare_get.constprop.0+0xb9/0x170\n[ 136.616105] rss_prepare_get.constprop.0+0xb9/0x170\n[ 136.616114] ethnl_default_doit+0x107/0x3d0\n[ 136.616131] genl_family_rcv_msg_doit+0x100/0x160\n[ 136.616147] genl_rcv_msg+0x1b8/0x2c0\n[ 136.616156] ? __pfx_ethnl_default_doit+0x10/0x10\n[ 136.616168] ? __pfx_genl_rcv_msg+0x10/0x10\n[ 136.616176] netlink_rcv_skb+0x58/0x110\n[ 136.616186] genl_rcv+0x28/0x40\n[ 136.616195] netlink_unicast+0x19b/0x290\n[ 136.616206] netlink_sendmsg+0x222/0x490\n[ 136.616215] __sys_sendto+0x1fd/0x210\n[ 136.616233] __x64_sys_sendto+0x24/0x30\n[ 136.616242] do_syscall_64+0x82/0x160\n[ 136.616252] ? __sys_recvmsg+0x83/0xe0\n[ 136.616265] ? syscall_exit_to_user_mode+0x10/0x210\n[ 136.616275] ? do_syscall_64+0x8e/0x160\n[ 136.616282] ? __count_memcg_events+0xa1/0x130\n[ 136.616295] ? count_memcg_events.constprop.0+0x1a/0x30\n[ 136.616306] ? handle_mm_fault+0xae/0x2d0\n[ 136.616319] ? do_user_addr_fault+0x379/0x670\n[ 136.616328] ? clear_bhb_loop+0x45/0xa0\n[ 136.616340] ? clear_bhb_loop+0x45/0xa0\n[ 136.616349] ? clear_bhb_loop+0x45/0xa0\n[ 136.616359] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 136.616369] RIP: 0033:0x7fd30ba7b047\n[ 136.616376] Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d bd d5 0c 00 00 41 89 ca 74 10 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 71 c3 55 48 83 ec 30 44 89 4c 24 2c 4c 89 44\n[ 136.616381] RSP: 002b:00007ffde1796d68 EFLAGS: 00000202 ORIG_RAX: 000000000000002c\n[ 136.616388] RAX: ffffffffffffffda RBX: 000055d7bd89f2a0 RCX: 00007fd30ba7b047\n[ 136.616392] RDX: 0000000000000028 RSI: 000055d7bd89f3b0 RDI: 0000000000000003\n[ 136.616396] RBP: 00007ffde1796e10 R08: 00007fd30bb4e200 R09: 000000000000000c\n[ 136.616399] R10: 0000000000000000 R11: 0000000000000202 R12: 000055d7bd89f340\n[ 136.616403] R13: 000055d7bd89f3b0 R14: 000055d78943f200 R15: 0000000000000000" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: idpf: devolver un tama\u00f1o 0 para la clave RSS si no se admite. Devolver -EOPNOTSUPP desde una funci\u00f3n que devuelve u32 provoca una conversi\u00f3n y, como resultado, un valor de tama\u00f1o no v\u00e1lido. Usar -EOPNOTSUPP como tama\u00f1o probablemente provocar\u00e1 un error de asignaci\u00f3n. Comando: ethtool -x eth0. Es visible en todos los dispositivos que no tienen configurados los l\u00edmites RSS. [ 136.615917] Call Trace: [ 136.615921] [ 136.615927] ? __warn+0x89/0x130 [ 136.615942] ? __alloc_frozen_pages_noprof+0x322/0x330 [ 136.615953] ? report_bug+0x164/0x190 [ 136.615968] ? handle_bug+0x58/0x90 [ 136.615979] ? exc_invalid_op+0x17/0x70 [ 136.615987] ? asm_exc_invalid_op+0x1a/0x20 [ 136.616001] ? rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616016] ? __alloc_frozen_pages_noprof+0x322/0x330 [ 136.616028] __alloc_pages_noprof+0xe/0x20 [ 136.616038] ___kmalloc_large_node+0x80/0x110 [ 136.616072] __kmalloc_large_node_noprof+0x1d/0xa0 [ 136.616081] __kmalloc_noprof+0x32c/0x4c0 [ 136.616098] ? rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616105] rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616114] ethnl_default_doit+0x107/0x3d0 [ 136.616131] genl_family_rcv_msg_doit+0x100/0x160 [ 136.616147] genl_rcv_msg+0x1b8/0x2c0 [ 136.616156] ? __pfx_ethnl_default_doit+0x10/0x10 [ 136.616168] ? __pfx_genl_rcv_msg+0x10/0x10 [ 136.616176] netlink_rcv_skb+0x58/0x110 [ 136.616186] genl_rcv+0x28/0x40 [ 136.616195] netlink_unicast+0x19b/0x290 [ 136.616206] netlink_sendmsg+0x222/0x490 [ 136.616215] __sys_sendto+0x1fd/0x210 [ 136.616233] __x64_sys_sendto+0x24/0x30 [ 136.616242] do_syscall_64+0x82/0x160 [ 136.616252] ? __sys_recvmsg+0x83/0xe0 [ 136.616265] ? syscall_exit_to_user_mode+0x10/0x210 [ 136.616275] ? do_syscall_64+0x8e/0x160 [ 136.616282] ? __count_memcg_events+0xa1/0x130 [ 136.616295] ? count_memcg_events.constprop.0+0x1a/0x30 [ 136.616306] ? handle_mm_fault+0xae/0x2d0 [ 136.616319] ? do_user_addr_fault+0x379/0x670 [ 136.616328] ? clear_bhb_loop+0x45/0xa0 [ 136.616340] ? clear_bhb_loop+0x45/0xa0 [ 136.616349] ? clear_bhb_loop+0x45/0xa0 [ 136.616359] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 136.616369] RIP: 0033:0x7fd30ba7b047 [ 136.616376] Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d bd d5 0c 00 00 41 89 ca 74 10 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 71 c3 55 48 83 ec 30 44 89 4c 24 2c 4c 89 44 [ 136.616381] RSP: 002b:00007ffde1796d68 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 136.616388] RAX: ffffffffffffffda RBX: 000055d7bd89f2a0 RCX: 00007fd30ba7b047 [ 136.616392] RDX: 0000000000000028 RSI: 000055d7bd89f3b0 RDI: 0000000000000003 [ 136.616396] RBP: 00007ffde1796e10 R08: 00007fd30bb4e200 R09: 000000000000000c [ 136.616399] R10: 0000000000000000 R11: 0000000000000202 R12: 000055d7bd89f340 [ 136.616403] R13: 000055d7bd89f3b0 R14: 000055d78943f200 R15: 0000000000000000" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38403.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38403.json index 4b9acd0c53b..b5e9173191b 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38403.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38403.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: Clear the vmci transport packet properly when initializing it\n\nIn vmci_transport_packet_init memset the vmci_transport_packet before\npopulating the fields to avoid any uninitialised data being left in the\nstructure." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vsock/vmci: borre el paquete de transporte vmci correctamente al inicializarlo. En vmci_transport_packet_init, configure el vmci_transport_packet antes de completar los campos para evitar que queden datos sin inicializar en la estructura." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38404.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38404.json index 0c763fc7899..a0927dcb7d7 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38404.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38404.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: displayport: Fix potential deadlock\n\nThe deadlock can occur due to a recursive lock acquisition of\n`cros_typec_altmode_data::mutex`.\nThe call chain is as follows:\n1. cros_typec_altmode_work() acquires the mutex\n2. typec_altmode_vdm() -> dp_altmode_vdm() ->\n3. typec_altmode_exit() -> cros_typec_altmode_exit()\n4. cros_typec_altmode_exit() attempts to acquire the mutex again\n\nTo prevent this, defer the `typec_altmode_exit()` call by scheduling\nit rather than calling it directly from within the mutex-protected\ncontext." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: typec: displayport: Soluciona un posible bloqueo El bloqueo puede ocurrir debido a una adquisici\u00f3n de bloqueo recursiva de `cros_typec_altmode_data::mutex`. La cadena de llamadas es la siguiente: 1. cros_typec_altmode_work() adquiere el mutex 2. typec_altmode_vdm() -> dp_altmode_vdm() -> 3. typec_altmode_exit() -> cros_typec_altmode_exit() 4. cros_typec_altmode_exit() intenta adquirir el mutex de nuevo Para evitar esto, aplaza la llamada a `typec_altmode_exit()` program\u00e1ndola en lugar de llamarla directamente desde dentro del contexto protegido por mutex." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38405.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38405.json index de602931ff7..5e35b947cb6 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38405.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38405.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix memory leak of bio integrity\n\nIf nvmet receives commands with metadata there is a continuous memory\nleak of kmalloc-128 slab or more precisely bio->bi_integrity.\n\nSince commit bf4c89fc8797 (\"block: don't call bio_uninit from bio_endio\")\neach user of bio_init has to use bio_uninit as well. Otherwise the bio\nintegrity is not getting free. Nvmet uses bio_init for inline bios.\n\nUninit the inline bio to complete deallocation of integrity in bio." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvmet: se corrige una fuga de memoria de la integridad de la bio. Si nvmet recibe comandos con metadatos, se produce una fuga de memoria continua de la slab kmalloc-128 o, m\u00e1s precisamente, bio->bi_integrity. Desde el commit bf4c89fc8797 (\"bloqueo: no llamar a bio_uninit desde bio_endio\"), cada usuario de bio_init debe usar tambi\u00e9n bio_uninit. De lo contrario, la integridad de la bio no se libera. nvmet usa bio_init para la bios en l\u00ednea. Desinicie la bios en l\u00ednea para completar la desasignaci\u00f3n de la integridad en la bio." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38406.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38406.json index b9a47450336..aa626b17087 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38406.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38406.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: remove WARN on bad firmware input\n\nIf the firmware gives bad input, that's nothing to do with\nthe driver's stack at this point etc., so the WARN_ON()\ndoesn't add any value. Additionally, this is one of the\ntop syzbot reports now. Just print a message, and as an\nadded bonus, print the sizes too." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath6kl: eliminar WARN sobre entrada de firmware incorrecta. Si el firmware genera una entrada incorrecta, no tiene nada que ver con la pila del controlador en este momento, etc., por lo que WARN_ON() no aporta ning\u00fan valor. Adem\u00e1s, este es uno de los principales reportes de syzbot. Simplemente imprime un mensaje y, como extra, tambi\u00e9n imprime los tama\u00f1os." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38407.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38407.json index c5d831b9b0a..67b218262b7 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38407.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38407.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: cpu_ops_sbi: Use static array for boot_data\n\nSince commit 6b9f29b81b15 (\"riscv: Enable pcpu page first chunk\nallocator\"), if NUMA is enabled, the page percpu allocator may be used\non very sparse configurations, or when requested on boot with\npercpu_alloc=page.\n\nIn that case, percpu data gets put in the vmalloc area. However,\nsbi_hsm_hart_start() needs the physical address of a sbi_hart_boot_data,\nand simply assumes that __pa() would work. This causes the just started\nhart to immediately access an invalid address and hang.\n\nFortunately, struct sbi_hart_boot_data is not too large, so we can\nsimply allocate an array for boot_data statically, putting it in the\nkernel image.\n\nThis fixes NUMA=y SMP boot on Sophgo SG2042.\n\nTo reproduce on QEMU: Set CONFIG_NUMA=y and CONFIG_DEBUG_VIRTUAL=y, then\nrun with:\n\n qemu-system-riscv64 -M virt -smp 2 -nographic \\\n -kernel arch/riscv/boot/Image \\\n -append \"percpu_alloc=page\"\n\nKernel output:\n\n[ 0.000000] Booting Linux on hartid 0\n[ 0.000000] Linux version 6.16.0-rc1 (dram@sakuya) (riscv64-unknown-linux-gnu-gcc (GCC) 14.2.1 20250322, GNU ld (GNU Binutils) 2.44) #11 SMP Tue Jun 24 14:56:22 CST 2025\n...\n[ 0.000000] percpu: 28 4K pages/cpu s85784 r8192 d20712\n...\n[ 0.083192] smp: Bringing up secondary CPUs ...\n[ 0.086722] ------------[ cut here ]------------\n[ 0.086849] virt_to_phys used for non-linear address: (____ptrval____) (0xff2000000001d080)\n[ 0.088001] WARNING: CPU: 0 PID: 1 at arch/riscv/mm/physaddr.c:14 __virt_to_phys+0xae/0xe8\n[ 0.088376] Modules linked in:\n[ 0.088656] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.16.0-rc1 #11 NONE\n[ 0.088833] Hardware name: riscv-virtio,qemu (DT)\n[ 0.088948] epc : __virt_to_phys+0xae/0xe8\n[ 0.089001] ra : __virt_to_phys+0xae/0xe8\n[ 0.089037] epc : ffffffff80021eaa ra : ffffffff80021eaa sp : ff2000000004bbc0\n[ 0.089057] gp : ffffffff817f49c0 tp : ff60000001d60000 t0 : 5f6f745f74726976\n[ 0.089076] t1 : 0000000000000076 t2 : 705f6f745f747269 s0 : ff2000000004bbe0\n[ 0.089095] s1 : ff2000000001d080 a0 : 0000000000000000 a1 : 0000000000000000\n[ 0.089113] a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000\n[ 0.089131] a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000000000000\n[ 0.089155] s2 : ffffffff8130dc00 s3 : 0000000000000001 s4 : 0000000000000001\n[ 0.089174] s5 : ffffffff8185eff8 s6 : ff2000007f1eb000 s7 : ffffffff8002a2ec\n[ 0.089193] s8 : 0000000000000001 s9 : 0000000000000001 s10: 0000000000000000\n[ 0.089211] s11: 0000000000000000 t3 : ffffffff8180a9f7 t4 : ffffffff8180a9f7\n[ 0.089960] t5 : ffffffff8180a9f8 t6 : ff2000000004b9d8\n[ 0.089984] status: 0000000200000120 badaddr: ffffffff80021eaa cause: 0000000000000003\n[ 0.090101] [] __virt_to_phys+0xae/0xe8\n[ 0.090228] [] sbi_cpu_start+0x6e/0xe8\n[ 0.090247] [] __cpu_up+0x1e/0x8c\n[ 0.090260] [] bringup_cpu+0x42/0x258\n[ 0.090277] [] cpuhp_invoke_callback+0xe0/0x40c\n[ 0.090292] [] __cpuhp_invoke_callback_range+0x68/0xfc\n[ 0.090320] [] _cpu_up+0x11a/0x244\n[ 0.090334] [] cpu_up+0x52/0x90\n[ 0.090384] [] bringup_nonboot_cpus+0x78/0x118\n[ 0.090411] [] smp_init+0x34/0xb8\n[ 0.090425] [] kernel_init_freeable+0x148/0x2e4\n[ 0.090442] [] kernel_init+0x1e/0x14c\n[ 0.090455] [] ret_from_fork_kernel+0xe/0xf0\n[ 0.090471] [] ret_from_fork_kernel_asm+0x16/0x18\n[ 0.090560] ---[ end trace 0000000000000000 ]---\n[ 1.179875] CPU1: failed to come online\n[ 1.190324] smp: Brought up 1 node, 1 CPU" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: cpu_ops_sbi: Usar una matriz est\u00e1tica para boot_data. Desde el commit 6b9f29b81b15 (\"riscv: Habilitar el asignador de primer fragmento de p\u00e1gina pcpu\"), si NUMA est\u00e1 habilitado, el asignador de p\u00e1ginas por CPU puede usarse en configuraciones muy dispersas o cuando se solicita al arrancar con percpu_alloc=page. En ese caso, los datos por CPU se colocan en el \u00e1rea vmalloc. Sin embargo, sbi_hsm_hart_start() necesita la direcci\u00f3n f\u00edsica de sbi_hart_boot_data y simplemente asume que __pa() funcionar\u00eda. Esto provoca que el hart reci\u00e9n iniciado acceda inmediatamente a una direcci\u00f3n no v\u00e1lida y se cuelgue. Afortunadamente, la estructura sbi_hart_boot_data no es demasiado grande, por lo que podemos asignar una matriz est\u00e1ticamente para boot_data, coloc\u00e1ndola en la imagen del kernel. Esto soluciona el problema del arranque SMP con NUMA=y en Sophgo SG2042. Para reproducir en QEMU: Establezca CONFIG_NUMA=y y CONFIG_DEBUG_VIRTUAL=y, luego ejecute con: qemu-system-riscv64 -M virt -smp 2 -nographic \\ -kernel arch/riscv/boot/Image \\ -append \"percpu_alloc=page\" Salida del kernel: [ 0.000000] Booting Linux on hartid 0 [ 0.000000] Linux version 6.16.0-rc1 (dram@sakuya) (riscv64-unknown-linux-gnu-gcc (GCC) 14.2.1 20250322, GNU ld (GNU Binutils) 2.44) #11 SMP Tue Jun 24 14:56:22 CST 2025 ... [ 0.000000] percpu: 28 4K pages/cpu s85784 r8192 d20712 ... [ 0.083192] smp: Bringing up secondary CPUs ... [ 0.086722] ------------[ cut here ]------------ [ 0.086849] virt_to_phys used for non-linear address: (____ptrval____) (0xff2000000001d080) [ 0.088001] WARNING: CPU: 0 PID: 1 at arch/riscv/mm/physaddr.c:14 __virt_to_phys+0xae/0xe8 [ 0.088376] Modules linked in: [ 0.088656] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.16.0-rc1 #11 NONE [ 0.088833] Hardware name: riscv-virtio,qemu (DT) [ 0.088948] epc : __virt_to_phys+0xae/0xe8 [ 0.089001] ra : __virt_to_phys+0xae/0xe8 [ 0.089037] epc : ffffffff80021eaa ra : ffffffff80021eaa sp : ff2000000004bbc0 [ 0.089057] gp : ffffffff817f49c0 tp : ff60000001d60000 t0 : 5f6f745f74726976 [ 0.089076] t1 : 0000000000000076 t2 : 705f6f745f747269 s0 : ff2000000004bbe0 [ 0.089095] s1 : ff2000000001d080 a0 : 0000000000000000 a1 : 0000000000000000 [ 0.089113] a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000 [ 0.089131] a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000000000000 [ 0.089155] s2 : ffffffff8130dc00 s3 : 0000000000000001 s4 : 0000000000000001 [ 0.089174] s5 : ffffffff8185eff8 s6 : ff2000007f1eb000 s7 : ffffffff8002a2ec [ 0.089193] s8 : 0000000000000001 s9 : 0000000000000001 s10: 0000000000000000 [ 0.089211] s11: 0000000000000000 t3 : ffffffff8180a9f7 t4 : ffffffff8180a9f7 [ 0.089960] t5 : ffffffff8180a9f8 t6 : ff2000000004b9d8 [ 0.089984] status: 0000000200000120 badaddr: ffffffff80021eaa cause: 0000000000000003 [ 0.090101] [] __virt_to_phys+0xae/0xe8 [ 0.090228] [] sbi_cpu_start+0x6e/0xe8 [ 0.090247] [] __cpu_up+0x1e/0x8c [ 0.090260] [] bringup_cpu+0x42/0x258 [ 0.090277] [] cpuhp_invoke_callback+0xe0/0x40c [ 0.090292] [] __cpuhp_invoke_callback_range+0x68/0xfc [ 0.090320] [] _cpu_up+0x11a/0x244 [ 0.090334] [] cpu_up+0x52/0x90 [ 0.090384] [] bringup_nonboot_cpus+0x78/0x118 [ 0.090411] [] smp_init+0x34/0xb8 [ 0.090425] [] kernel_init_freeable+0x148/0x2e4 [ 0.090442] [] kernel_init+0x1e/0x14c [ 0.090455] [] ret_from_fork_kernel+0xe/0xf0 [ 0.090471] [] ret_from_fork_kernel_asm+0x16/0x18 [ 0.090560] ---[ end trace 0000000000000000 ]--- [ 1.179875] CPU1: failed to come online [ 1.190324] smp: Brought up 1 node, 1 CPU" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38408.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38408.json index bffb01509b1..cafcd82c561 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38408.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38408.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngenirq/irq_sim: Initialize work context pointers properly\n\nInitialize `ops` member's pointers properly by using kzalloc() instead of\nkmalloc() when allocating the simulation work context. Otherwise the\npointers contain random content leading to invalid dereferencing." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: genirq/irq_sim: Inicializar correctamente los punteros del contexto de trabajo. Inicializar correctamente los punteros del miembro `ops` usando kzalloc() en lugar de kmalloc() al asignar el contexto de trabajo de simulaci\u00f3n. De lo contrario, los punteros contienen contenido aleatorio, lo que provoca una desreferenciaci\u00f3n no v\u00e1lida." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38409.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38409.json index fec5b1fd2d9..52c37f650b1 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38409.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38409.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix another leak in the submit error path\n\nput_unused_fd() doesn't free the installed file, if we've already done\nfd_install(). So we need to also free the sync_file.\n\nPatchwork: https://patchwork.freedesktop.org/patch/653583/" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/msm: Se corrige otra fuga en la ruta de error de env\u00edo. Put_unused_fd() no libera el archivo instalado si ya se ha ejecutado fd_install(). Por lo tanto, tambi\u00e9n es necesario liberar el archivo sync_file. Patchwork: https://patchwork.freedesktop.org/patch/653583/" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38410.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38410.json index 84ff1527937..229b3f730ce 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38410.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38410.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix a fence leak in submit error path\n\nIn error paths, we could unref the submit without calling\ndrm_sched_entity_push_job(), so msm_job_free() will never get\ncalled. Since drm_sched_job_cleanup() will NULL out the\ns_fence, we can use that to detect this case.\n\nPatchwork: https://patchwork.freedesktop.org/patch/653584/" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/msm: Se corrige una fuga de la valla en la ruta de error de env\u00edo. En las rutas de error, podr\u00edamos eliminar la referencia del env\u00edo sin llamar a drm_sched_entity_push_job(), por lo que msm_job_free() nunca se llamar\u00eda. Dado que drm_sched_job_cleanup() anular\u00e1 la s_fence, podemos usarla para detectar este caso. Patchwork: https://patchwork.freedesktop.org/patch/653584/" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38411.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38411.json index 9bcadadf287..6c3210e83ae 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38411.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38411.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix double put of request\n\nIf a netfs request finishes during the pause loop, it will have the ref\nthat belongs to the IN_PROGRESS flag removed at that point - however, if it\nthen goes to the final wait loop, that will *also* put the ref because it\nsees that the IN_PROGRESS flag is clear and incorrectly assumes that this\nhappened when it called the collector.\n\nIn fact, since IN_PROGRESS is clear, we shouldn't call the collector again\nsince it's done all the cleanup, such as calling ->ki_complete().\n\nFix this by making netfs_collect_in_app() just return, indicating that\nwe're done if IN_PROGRESS is removed." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfs: Corregir doble put de solicitud Si una solicitud netfs finaliza durante el bucle de pausa, tendr\u00e1 la referencia que pertenece al indicador IN_PROGRESS eliminada en ese punto; sin embargo, si luego va al bucle de espera final, eso *tambi\u00e9n* pondr\u00e1 la referencia porque ve que el indicador IN_PROGRESS est\u00e1 limpio y asume incorrectamente que esto sucedi\u00f3 cuando llam\u00f3 al recopilador. De hecho, como IN_PROGRESS est\u00e1 limpio, no deber\u00edamos volver a llamar al recopilador ya que ha hecho toda la limpieza, como llamar a ->ki_complete(). Corrija esto haciendo que netfs_collect_in_app() simplemente regrese, lo que indica que hemos terminado si se elimina IN_PROGRESS." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38412.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38412.json index 0c776eef4f1..c8ca141c7ca 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38412.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38412.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks\n\nAfter retrieving WMI data blocks in sysfs callbacks, check for the\nvalidity of them before dereferencing their content." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: plataforma/x86: dell-wmi-sysman: reparar la recuperaci\u00f3n de bloques de datos WMI en devoluciones de llamadas sysfs Despu\u00e9s de recuperar bloques de datos WMI en devoluciones de llamadas sysfs, verifique su validez antes de desreferenciar su contenido." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38413.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38413.json index a6d177eaa71..2f50822581a 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38413.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38413.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: xsk: rx: fix the frame's length check\n\nWhen calling buf_to_xdp, the len argument is the frame data's length\nwithout virtio header's length (vi->hdr_len). We check that len with\n\n\txsk_pool_get_rx_frame_size() + vi->hdr_len\n\nto ensure the provided len does not larger than the allocated chunk\nsize. The additional vi->hdr_len is because in virtnet_add_recvbuf_xsk,\nwe use part of XDP_PACKET_HEADROOM for virtio header and ask the vhost\nto start placing data from\n\n\thard_start + XDP_PACKET_HEADROOM - vi->hdr_len\nnot\n\thard_start + XDP_PACKET_HEADROOM\n\nBut the first buffer has virtio_header, so the maximum frame's length in\nthe first buffer can only be\n\n\txsk_pool_get_rx_frame_size()\nnot\n\txsk_pool_get_rx_frame_size() + vi->hdr_len\n\nlike in the current check.\n\nThis commit adds an additional argument to buf_to_xdp differentiate\nbetween the first buffer and other ones to correctly calculate the maximum\nframe's length." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: virtio-net: xsk: rx: correcci\u00f3n de la comprobaci\u00f3n de la longitud del marco. Al llamar a buf_to_xdp, el argumento len es la longitud de los datos del marco sin la longitud del encabezado de Virtio (vi->hdr_len). Comprobamos esta longitud con xsk_pool_get_rx_frame_size() + vi->hdr_len para garantizar que la longitud proporcionada no supere el tama\u00f1o del fragmento asignado. El valor adicional de vi->hdr_len se debe a que, en virtnet_add_recvbuf_xsk, usamos parte de XDP_PACKET_HEADROOM para el encabezado de virtio y solicitamos al vhost que comience a colocar datos desde hard_start + XDP_PACKET_HEADROOM - vi->hdr_len, no hard_start + XDP_PACKET_HEADROOM. Sin embargo, el primer b\u00fafer tiene virtio_header, por lo que la longitud m\u00e1xima del fotograma en el primer b\u00fafer solo puede ser xsk_pool_get_rx_frame_size(), no xsk_pool_get_rx_frame_size() + vi->hdr_len, como en la comprobaci\u00f3n actual. Este commit a\u00f1ade un argumento adicional a buf_to_xdp para diferenciar entre el primer b\u00fafer y los dem\u00e1s y calcular correctamente la longitud m\u00e1xima del fotograma." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38414.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38414.json index 31d715313f3..a8107a1280d 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38414.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38414.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850\n\nGCC_GCC_PCIE_HOT_RST is wrongly defined for WCN7850, causing kernel crash\non some specific platforms.\n\nSince this register is divergent for WCN7850 and QCN9274, move it to\nregister table to allow different definitions. Then correct the register\naddress for WCN7850 to fix this issue.\n\nNote IPQ5332 is not affected as it is not PCIe based device.\n\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: ath12k: correcci\u00f3n de la definici\u00f3n de GCC_GCC_PCIE_HOT_RST para WCN7850. GCC_GCC_PCIE_HOT_RST est\u00e1 mal definido para WCN7850, lo que provoca un fallo del kernel en algunas plataformas espec\u00edficas. Dado que este registro es divergente para WCN7850 y QCN9274, mu\u00e9valo a la tabla de registros para permitir definiciones diferentes. A continuaci\u00f3n, corrija la direcci\u00f3n del registro de WCN7850 para solucionar este problema. Nota: IPQ5332 no se ve afectado, ya que no es un dispositivo basado en PCIe. Probado en: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38415.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38415.json index 0aa0466d66b..45eb48a7eef 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38415.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38415.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check return result of sb_min_blocksize\n\nSyzkaller reports an \"UBSAN: shift-out-of-bounds in squashfs_bio_read\" bug.\n\nSyzkaller forks multiple processes which after mounting the Squashfs\nfilesystem, issues an ioctl(\"/dev/loop0\", LOOP_SET_BLOCK_SIZE, 0x8000). \nNow if this ioctl occurs at the same time another process is in the\nprocess of mounting a Squashfs filesystem on /dev/loop0, the failure\noccurs. When this happens the following code in squashfs_fill_super()\nfails.\n\n----\nmsblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);\nmsblk->devblksize_log2 = ffz(~msblk->devblksize);\n----\n\nsb_min_blocksize() returns 0, which means msblk->devblksize is set to 0.\n\nAs a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2\nis set to 64.\n\nThis subsequently causes the\n\nUBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36\nshift exponent 64 is too large for 64-bit type 'u64' (aka\n'unsigned long long')\n\nThis commit adds a check for a 0 return by sb_min_blocksize()." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Squashfs: comprobar el resultado devuelto de sb_min_blocksize. Syzkaller informa del error \"UBSAN: desplazamiento fuera de los l\u00edmites en squashfs_bio_read\". Syzkaller bifurca varios procesos que, tras montar el sistema de archivos Squashfs, emiten una instrucci\u00f3n ioctl(\"/dev/loop0\", LOOP_SET_BLOCK_SIZE, 0x8000). Si esta instrucci\u00f3n ioctl se produce al mismo tiempo que otro proceso est\u00e1 montando un sistema de archivos Squashfs en /dev/loop0, se produce el fallo. En este caso, el siguiente c\u00f3digo en squashfs_fill_super() falla: ---- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); msblk->devblksize_log2 = ffz(~msblk->devblksize); ---- sb_min_blocksize() devuelve 0, lo que significa que msblk->devblksize est\u00e1 establecido en 0. Como resultado, ffz(~msblk->devblksize) devuelve 64 y msblk->devblksize_log2 est\u00e1 establecido en 64. Esto posteriormente provoca el UBSAN: shift-out-of-bounds en fs/squashfs/block.c:195:36 el exponente de desplazamiento 64 es demasiado grande para el tipo de 64 bits 'u64' (tambi\u00e9n conocido como 'unsigned long long') Esta confirmaci\u00f3n agrega una comprobaci\u00f3n para un retorno de 0 por sb_min_blocksize()." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38416.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38416.json index 61d5f2f14d6..7e96e0add6d 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38416.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38416.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nci: uart: Set tty->disc_data only in success path\n\nSetting tty->disc_data before opening the NCI device means we need to\nclean it up on error paths. This also opens some short window if device\nstarts sending data, even before NCIUARTSETDRIVER IOCTL succeeded\n(broken hardware?). Close the window by exposing tty->disc_data only on\nthe success path, when opening of the NCI device and try_module_get()\nsucceeds.\n\nThe code differs in error path in one aspect: tty->disc_data won't be\never assigned thus NULL-ified. This however should not be relevant\ndifference, because of \"tty->disc_data=NULL\" in nci_uart_tty_open()." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFC: nci: uart: Establecer tty->disc_data solo en la ruta correcta. Configurar tty->disc_data antes de abrir el dispositivo NCI implica la necesidad de eliminar las rutas de error. Esto tambi\u00e9n genera una peque\u00f1a ventana de tiempo si el dispositivo comienza a enviar datos, incluso antes de que NCIUARTSETDRIVER IOCTL se haya ejecutado correctamente (\u00bfhardware da\u00f1ado?). Esta ventana se cierra exponiendo tty->disc_data solo en la ruta correcta cuando se abre el dispositivo NCI y try_module_get() se ejecuta correctamente. El c\u00f3digo difiere en la ruta de error en un aspecto: tty->disc_data nunca se asignar\u00e1, por lo que se convierte en NULL. Sin embargo, esta diferencia no deber\u00eda ser relevante, debido a \"tty->disc_data=NULL\" en nci_uart_tty_open()." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38417.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38417.json index ff82e1fab1d..24f7c1c89af 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38417.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38417.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix eswitch code memory leak in reset scenario\n\nAdd simple eswitch mode checker in attaching VF procedure and allocate\nrequired port representor memory structures only in switchdev mode.\nThe reset flows triggers VF (if present) detach/attach procedure.\nIt might involve VF port representor(s) re-creation if the device is\nconfigured is switchdev mode (not legacy one).\nThe memory was blindly allocated in current implementation,\nregardless of the mode and not freed if in legacy mode.\n\nKmemeleak trace:\nunreferenced object (percpu) 0x7e3bce5b888458 (size 40):\n comm \"bash\", pid 1784, jiffies 4295743894\n hex dump (first 32 bytes on cpu 45):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace (crc 0):\n pcpu_alloc_noprof+0x4c4/0x7c0\n ice_repr_create+0x66/0x130 [ice]\n ice_repr_create_vf+0x22/0x70 [ice]\n ice_eswitch_attach_vf+0x1b/0xa0 [ice]\n ice_reset_all_vfs+0x1dd/0x2f0 [ice]\n ice_pci_err_resume+0x3b/0xb0 [ice]\n pci_reset_function+0x8f/0x120\n reset_store+0x56/0xa0\n kernfs_fop_write_iter+0x120/0x1b0\n vfs_write+0x31c/0x430\n ksys_write+0x61/0xd0\n do_syscall_64+0x5b/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nTesting hints (ethX is PF netdev):\n- create at least one VF\n echo 1 > /sys/class/net/ethX/device/sriov_numvfs\n- trigger the reset\n echo 1 > /sys/class/net/ethX/device/reset" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: se corrige la fuga de memoria del c\u00f3digo de eswitch en el escenario de reinicio. Se a\u00f1ade un verificador simple del modo eswitch al procedimiento de conexi\u00f3n de VF y se asignan las estructuras de memoria requeridas para el representante de puerto solo en el modo switchdev. Los flujos de reinicio activan el procedimiento de desconexi\u00f3n/conexi\u00f3n de VF (si est\u00e1 presente). Podr\u00eda implicar la recreaci\u00f3n del/de los representante(s) de puerto de VF si el dispositivo est\u00e1 configurado en modo switchdev (no en el modo heredado). La memoria se asignaba ciegamente en la implementaci\u00f3n actual, independientemente del modo, y no se liberaba en el modo heredado. Rastreo de Kmemeleak: objeto sin referencia (percpu) 0x7e3bce5b888458 (size 40): comm \"bash\", pid 1784, jiffies 4295743894 hex dump (first 32 bytes on cpu 45): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): pcpu_alloc_noprof+0x4c4/0x7c0 ice_repr_create+0x66/0x130 [ice] ice_repr_create_vf+0x22/0x70 [ice] ice_eswitch_attach_vf+0x1b/0xa0 [ice] ice_reset_all_vfs+0x1dd/0x2f0 [ice] ice_pci_err_resume+0x3b/0xb0 [ice] pci_reset_function+0x8f/0x120 reset_store+0x56/0xa0 kernfs_fop_write_iter+0x120/0x1b0 vfs_write+0x31c/0x430 ksys_write+0x61/0xd0 do_syscall_64+0x5b/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Testing hints (ethX is PF netdev): - create at least one VF echo 1 > /sys/class/net/ethX/device/sriov_numvfs - trigger the reset echo 1 > /sys/class/net/ethX/device/reset" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38418.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38418.json index 4cec5b35c8f..b623f64685e 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38418.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38418.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: core: Release rproc->clean_table after rproc_attach() fails\n\nWhen rproc->state = RPROC_DETACHED is attached to remote processor\nthrough rproc_attach(), if rproc_handle_resources() returns failure,\nthen the clean table should be released, otherwise the following\nmemory leak will occur.\n\nunreferenced object 0xffff000086a99800 (size 1024):\ncomm \"kworker/u12:3\", pid 59, jiffies 4294893670 (age 121.140s)\nhex dump (first 32 bytes):\n00 00 00 00 00 80 00 00 00 00 00 00 00 00 10 00 ............\n00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 ............\nbacktrace:\n [<000000008bbe4ca8>] slab_post_alloc_hook+0x98/0x3fc\n [<000000003b8a272b>] __kmem_cache_alloc_node+0x13c/0x230\n [<000000007a507c51>] __kmalloc_node_track_caller+0x5c/0x260\n [<0000000037818dae>] kmemdup+0x34/0x60\n [<00000000610f7f57>] rproc_boot+0x35c/0x56c\n [<0000000065f8871a>] rproc_add+0x124/0x17c\n [<00000000497416ee>] imx_rproc_probe+0x4ec/0x5d4\n [<000000003bcaa37d>] platform_probe+0x68/0xd8\n [<00000000771577f9>] really_probe+0x110/0x27c\n [<00000000531fea59>] __driver_probe_device+0x78/0x12c\n [<0000000080036a04>] driver_probe_device+0x3c/0x118\n [<000000007e0bddcb>] __device_attach_driver+0xb8/0xf8\n [<000000000cf1fa33>] bus_for_each_drv+0x84/0xe4\n [<000000001a53b53e>] __device_attach+0xfc/0x18c\n [<00000000d1a2a32c>] device_initial_probe+0x14/0x20\n [<00000000d8f8b7ae>] bus_probe_device+0xb0/0xb4\n unreferenced object 0xffff0000864c9690 (size 16):" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: remoteproc: core: Liberar rproc->clean_table despu\u00e9s de que rproc_attach() falla Cuando rproc->state = RPROC_DETACHED se adjunta al procesador remoto a trav\u00e9s de rproc_attach(), si rproc_handle_resources() devuelve un error, entonces se debe liberar la tabla limpia; de lo contrario, se producir\u00e1 la siguiente p\u00e9rdida de memoria. unreferenced object 0xffff000086a99800 (size 1024): comm \"kworker/u12:3\", pid 59, jiffies 4294893670 (age 121.140s) hex dump (first 32 bytes): 00 00 00 00 00 80 00 00 00 00 00 00 00 00 10 00 ............ 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 ............ backtrace: [<000000008bbe4ca8>] slab_post_alloc_hook+0x98/0x3fc [<000000003b8a272b>] __kmem_cache_alloc_node+0x13c/0x230 [<000000007a507c51>] __kmalloc_node_track_caller+0x5c/0x260 [<0000000037818dae>] kmemdup+0x34/0x60 [<00000000610f7f57>] rproc_boot+0x35c/0x56c [<0000000065f8871a>] rproc_add+0x124/0x17c [<00000000497416ee>] imx_rproc_probe+0x4ec/0x5d4 [<000000003bcaa37d>] platform_probe+0x68/0xd8 [<00000000771577f9>] really_probe+0x110/0x27c [<00000000531fea59>] __driver_probe_device+0x78/0x12c [<0000000080036a04>] driver_probe_device+0x3c/0x118 [<000000007e0bddcb>] __device_attach_driver+0xb8/0xf8 [<000000000cf1fa33>] bus_for_each_drv+0x84/0xe4 [<000000001a53b53e>] __device_attach+0xfc/0x18c [<00000000d1a2a32c>] device_initial_probe+0x14/0x20 [<00000000d8f8b7ae>] bus_probe_device+0xb0/0xb4 unreferenced object 0xffff0000864c9690 (size 16):" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38419.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38419.json index 7fc2b35fbc6..8e28b4b4dbe 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38419.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38419.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()\n\nWhen rproc->state = RPROC_DETACHED and rproc_attach() is used\nto attach to the remote processor, if rproc_handle_resources()\nreturns a failure, the resources allocated by imx_rproc_prepare()\nshould be released, otherwise the following memory leak will occur.\n\nSince almost the same thing is done in imx_rproc_prepare() and\nrproc_resource_cleanup(), Function rproc_resource_cleanup() is able\nto deal with empty lists so it is better to fix the \"goto\" statements\nin rproc_attach(). replace the \"unprepare_device\" goto statement with\n\"clean_up_resources\" and get rid of the \"unprepare_device\" label.\n\nunreferenced object 0xffff0000861c5d00 (size 128):\ncomm \"kworker/u12:3\", pid 59, jiffies 4294893509 (age 149.220s)\nhex dump (first 32 bytes):\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 02 88 00 00 00 00 00 00 10 00 00 00 00 00 ............\nbacktrace:\n [<00000000f949fe18>] slab_post_alloc_hook+0x98/0x37c\n [<00000000adbfb3e7>] __kmem_cache_alloc_node+0x138/0x2e0\n [<00000000521c0345>] kmalloc_trace+0x40/0x158\n [<000000004e330a49>] rproc_mem_entry_init+0x60/0xf8\n [<000000002815755e>] imx_rproc_prepare+0xe0/0x180\n [<0000000003f61b4e>] rproc_boot+0x2ec/0x528\n [<00000000e7e994ac>] rproc_add+0x124/0x17c\n [<0000000048594076>] imx_rproc_probe+0x4ec/0x5d4\n [<00000000efc298a1>] platform_probe+0x68/0xd8\n [<00000000110be6fe>] really_probe+0x110/0x27c\n [<00000000e245c0ae>] __driver_probe_device+0x78/0x12c\n [<00000000f61f6f5e>] driver_probe_device+0x3c/0x118\n [<00000000a7874938>] __device_attach_driver+0xb8/0xf8\n [<0000000065319e69>] bus_for_each_drv+0x84/0xe4\n [<00000000db3eb243>] __device_attach+0xfc/0x18c\n [<0000000072e4e1a4>] device_initial_probe+0x14/0x20" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: remoteproc: core: Limpieza de recursos adquiridos cuando rproc_handle_resources() falla en rproc_attach(). Cuando rproc->state = RPROC_DETACHED y rproc_attach() se usa para conectarse al procesador remoto, si rproc_handle_resources() falla, se deben liberar los recursos asignados por imx_rproc_prepare(); de lo contrario, se producir\u00e1 la siguiente fuga de memoria. Dado que se realiza pr\u00e1cticamente lo mismo en imx_rproc_prepare() y rproc_resource_cleanup(), la funci\u00f3n rproc_resource_cleanup() puede procesar listas vac\u00edas, por lo que es recomendable corregir las instrucciones \"goto\" en rproc_attach(). Reemplace la instrucci\u00f3n goto \"unprepare_device\" por \"clean_up_resources\" y elimine la etiqueta \"unprepare_device\". unreferenced object 0xffff0000861c5d00 (size 128): comm \"kworker/u12:3\", pid 59, jiffies 4294893509 (age 149.220s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 02 88 00 00 00 00 00 00 10 00 00 00 00 00 ............ backtrace: [<00000000f949fe18>] slab_post_alloc_hook+0x98/0x37c [<00000000adbfb3e7>] __kmem_cache_alloc_node+0x138/0x2e0 [<00000000521c0345>] kmalloc_trace+0x40/0x158 [<000000004e330a49>] rproc_mem_entry_init+0x60/0xf8 [<000000002815755e>] imx_rproc_prepare+0xe0/0x180 [<0000000003f61b4e>] rproc_boot+0x2ec/0x528 [<00000000e7e994ac>] rproc_add+0x124/0x17c [<0000000048594076>] imx_rproc_probe+0x4ec/0x5d4 [<00000000efc298a1>] platform_probe+0x68/0xd8 [<00000000110be6fe>] really_probe+0x110/0x27c [<00000000e245c0ae>] __driver_probe_device+0x78/0x12c [<00000000f61f6f5e>] driver_probe_device+0x3c/0x118 [<00000000a7874938>] __device_attach_driver+0xb8/0xf8 [<0000000065319e69>] bus_for_each_drv+0x84/0xe4 [<00000000db3eb243>] __device_attach+0xfc/0x18c [<0000000072e4e1a4>] device_initial_probe+0x14/0x20" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38420.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38420.json index b2706d9ddf2..23dcfff533d 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38420.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38420.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: carl9170: do not ping device which has failed to load firmware\n\nSyzkaller reports [1, 2] crashes caused by an attempts to ping\nthe device which has failed to load firmware. Since such a device\ndoesn't pass 'ieee80211_register_hw()', an internal workqueue\nmanaged by 'ieee80211_queue_work()' is not yet created and an\nattempt to queue work on it causes null-ptr-deref.\n\n[1] https://syzkaller.appspot.com/bug?extid=9a4aec827829942045ff\n[2] https://syzkaller.appspot.com/bug?extid=0d8afba53e8fb2633217" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: carl9170: no hacer ping al dispositivo que no ha podido cargar el firmware. Syzkaller reporta [1, 2] fallos causados por intentos de hacer ping al dispositivo que no ha podido cargar el firmware. Dado que dicho dispositivo no supera la prueba 'ieee80211_register_hw()', a\u00fan no se crea una cola de trabajo interna administrada por 'ieee80211_queue_work()' y cualquier intento de cola de trabajo en ella provoca un error de referencia nulo (PTR). [1] https://syzkaller.appspot.com/bug?extid=9a4aec827829942045ff [2] https://syzkaller.appspot.com/bug?extid=0d8afba53e8fb2633217" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38421.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38421.json index be91f781854..c62acd57772 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38421.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38421.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd: pmf: Use device managed allocations\n\nIf setting up smart PC fails for any reason then this can lead to\na double free when unloading amd-pmf. This is because dev->buf was\nfreed but never set to NULL and is again freed in amd_pmf_remove().\n\nTo avoid subtle allocation bugs in failures leading to a double free\nchange all allocations into device managed allocations." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: platform/x86/amd: pmf: Usar asignaciones administradas por dispositivo. Si la configuraci\u00f3n de Smart PC falla por cualquier motivo, esto puede provocar una doble liberaci\u00f3n al descargar amd-pmf. Esto se debe a que dev->buf se liber\u00f3, pero nunca se configur\u00f3 como NULL y se libera de nuevo en amd_pmf_remove(). Para evitar errores sutiles de asignaci\u00f3n en fallos que provoquen una doble liberaci\u00f3n, cambie todas las asignaciones a asignaciones administradas por dispositivo." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38422.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38422.json index 03589c536d4..125ec4d7fa1 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38422.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38422.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices\n\nMaximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb\nand 64 Kb respectively. Adjust max size definitions and return correct\nEEPROM length based on device. Also prevent out-of-bound read/write." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net:lan743x: Modificar el tama\u00f1o de la EEPROM y el OTP para dispositivos PCI1xxxx. El tama\u00f1o m\u00e1ximo de OTP y EEPROM para dispositivos Hearthstone PCI1xxxx es de 8 Kb y 64 Kb, respectivamente. Ajustar las definiciones de tama\u00f1o m\u00e1ximo y devolver la longitud correcta de la EEPROM seg\u00fan el dispositivo. Tambi\u00e9n se evita la lectura/escritura fuera de los l\u00edmites." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38423.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38423.json index f3325b26765..b3db86a1e72 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38423.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38423.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: wcd9375: Fix double free of regulator supplies\n\nDriver gets regulator supplies in probe path with\ndevm_regulator_bulk_get(), so should not call regulator_bulk_free() in\nerror and remove paths to avoid double free." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ASoC: codecs: wcd9375: Se corrige la doble liberaci\u00f3n de los suministros del regulador. El controlador obtiene los suministros del regulador en la ruta de la sonda con devm_regulator_bulk_get(), por lo que no deber\u00eda llamar a regulator_bulk_free() por error y eliminar las rutas para evitar la doble liberaci\u00f3n." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38424.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38424.json index 47e2cfe554e..5f7512faa6b 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38424.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38424.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix sample vs do_exit()\n\nBaisheng Gao reported an ARM64 crash, which Mark decoded as being a\nsynchronous external abort -- most likely due to trying to access\nMMIO in bad ways.\n\nThe crash further shows perf trying to do a user stack sample while in\nexit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address\nspace it is trying to access.\n\nIt turns out that we stop perf after we tear down the userspace mm; a\nreceipie for disaster, since perf likes to access userspace for\nvarious reasons.\n\nFlip this order by moving up where we stop perf in do_exit().\n\nAdditionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER\nto abort when the current task does not have an mm (exit_mm() makes\nsure to set current->mm = NULL; before commencing with the actual\nteardown). Such that CPU wide events don't trip on this same problem." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf: Fix sample vs do_exit() Baisheng Gao inform\u00f3 de un fallo de ARM64, que Mark decodific\u00f3 como una interrupci\u00f3n externa sincr\u00f3nica, probablemente debido a un intento de acceder a MMIO de forma incorrecta. El fallo muestra adem\u00e1s que perf intenta hacer una muestra de pila de usuario mientras est\u00e1 en tlb_finish_mmu() de exit_mmap(), es decir, mientras derriba el espacio de direcciones al que intenta acceder. Resulta que detenemos perf despu\u00e9s de derribar el mm del espacio de usuario; una receta para el desastre, ya que a perf le gusta acceder al espacio de usuario por varias razones. Invierta este orden subiendo donde detenemos perf en do_exit(). Adem\u00e1s, endurezca PERF_SAMPLE_CALLCHAIN y PERF_SAMPLE_STACK_USER para que se detengan cuando la tarea actual no tenga un mm (exit_mm() se asegura de establecer current->mm = NULL; antes de comenzar con el desmontaje real). De modo que los eventos de toda la CPU no se activen con este mismo problema." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38425.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38425.json index 3fd7daec7ae..c84670d3a7e 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38425.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38425.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: tegra: check msg length in SMBUS block read\n\nFor SMBUS block read, do not continue to read if the message length\npassed from the device is '0' or greater than the maximum allowed bytes." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i2c: tegra: verificar la longitud del mensaje en la lectura del bloque SMBUS Para la lectura del bloque SMBUS, no contin\u00fae leyendo si la longitud del mensaje pasado desde el dispositivo es '0' o mayor que el m\u00e1ximo de bytes permitidos." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38426.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38426.json index bf5563d35a9..3a8d09a4e55 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38426.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38426.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Add basic validation for RAS header\n\nIf RAS header read from EEPROM is corrupted, it could result in trying\nto allocate huge memory for reading the records. Add some validation to\nheader fields." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdgpu: Se ha a\u00f1adido validaci\u00f3n b\u00e1sica para el encabezado RAS. Si el encabezado RAS le\u00eddo desde la EEPROM est\u00e1 da\u00f1ado, podr\u00eda intentar asignar una gran cantidad de memoria para leer los registros. Se ha a\u00f1adido validaci\u00f3n a los campos del encabezado." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38427.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38427.json index 7cef14d06ae..273d54c4c90 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38427.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38427.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: screen_info: Relocate framebuffers behind PCI bridges\n\nApply PCI host-bridge window offsets to screen_info framebuffers. Fixes\ninvalid access to I/O memory.\n\nResources behind a PCI host bridge can be relocated by a certain offset\nin the kernel's CPU address range used for I/O. The framebuffer memory\nrange stored in screen_info refers to the CPU addresses as seen during\nboot (where the offset is 0). During boot up, firmware may assign a\ndifferent memory offset to the PCI host bridge and thereby relocating\nthe framebuffer address of the PCI graphics device as seen by the kernel.\nThe information in screen_info must be updated as well.\n\nThe helper pcibios_bus_to_resource() performs the relocation of the\nscreen_info's framebuffer resource (given in PCI bus addresses). The\nresult matches the I/O-memory resource of the PCI graphics device (given\nin CPU addresses). As before, we store away the information necessary to\nlater update the information in screen_info itself.\n\nCommit 78aa89d1dfba (\"firmware/sysfb: Update screen_info for relocated\nEFI framebuffers\") added the code for updating screen_info. It is based\non similar functionality that pre-existed in efifb. Efifb uses a pointer\nto the PCI resource, while the newer code does a memcpy of the region.\nHence efifb sees any updates to the PCI resource and avoids the issue.\n\nv3:\n- Only use struct pci_bus_region for PCI bus addresses (Bjorn)\n- Clarify address semantics in commit messages and comments (Bjorn)\nv2:\n- Fixed tags (Takashi, Ivan)\n- Updated information on efifb" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: video: screen_info: Reubicar framebuffers detr\u00e1s de puentes PCI. Aplicar desplazamientos de ventana del puente host PCI a los framebuffers de screen_info. Corrige el acceso no v\u00e1lido a la memoria de E/S. Los recursos detr\u00e1s de un puente host PCI se pueden reubicar mediante un desplazamiento determinado en el rango de direcciones de CPU del kernel utilizado para E/S. El rango de memoria del framebuffer almacenado en screen_info se refiere a las direcciones de CPU tal como se ven durante el arranque (donde el desplazamiento es 0). Durante el arranque, el firmware puede asignar un desplazamiento de memoria diferente al puente host PCI y, por lo tanto, reubicar la direcci\u00f3n del framebuffer del dispositivo gr\u00e1fico PCI tal como lo ve el kernel. La informaci\u00f3n en screen_info tambi\u00e9n debe actualizarse. El asistente pcibios_bus_to_resource() realiza la reubicaci\u00f3n del recurso framebuffer de screen_info (indicado en direcciones de bus PCI). El resultado coincide con el recurso de memoria de E/S del dispositivo gr\u00e1fico PCI (indicado en direcciones de CPU). Como antes, almacenamos la informaci\u00f3n necesaria para actualizarla posteriormente en screen_info. El commit 78aa89d1dfba (\"firmware/sysfb: Update screen_info for relocated EFI framebuffers\" agreg\u00f3 el c\u00f3digo para actualizar screen_info. Se basa en una funcionalidad similar a la que ya exist\u00eda en efifb. Efifb usa un puntero al recurso PCI, mientras que el c\u00f3digo m\u00e1s reciente realiza un memcpy de la regi\u00f3n. Por lo tanto, efifb detecta cualquier actualizaci\u00f3n del recurso PCI y evita el problema. v3: - Usar struct pci_bus_region solo para direcciones de bus PCI (Bjorn) - Aclarar la sem\u00e1ntica de las direcciones en los mensajes y comentarios de la confirmaci\u00f3n (Bjorn) v2: - Etiquetas corregidas (Takashi, Ivan) - Informaci\u00f3n actualizada sobre efifb" } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38428.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38428.json index 0eca245c3d7..383db5a5216 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38428.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38428.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: ims-pcu - check record size in ims_pcu_flash_firmware()\n\nThe \"len\" variable comes from the firmware and we generally do\ntrust firmware, but it's always better to double check. If the \"len\"\nis too large it could result in memory corruption when we do\n\"memcpy(fragment->data, rec->data, len);\"" + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Entrada: ims-pcu - comprobar el tama\u00f1o del registro en ims_pcu_flash_firmware(). La variable \"len\" proviene del firmware y, por lo general, confiamos en \u00e9l, pero siempre es mejor comprobarlo. Si el valor de \"len\" es demasiado grande, podr\u00eda provocar da\u00f1os en la memoria al ejecutar \"memcpy(fragment->data, rec->data, len);\"." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38429.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38429.json index 7de83d5ad57..7f74fc1c406 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38429.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38429.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: ep: Update read pointer only after buffer is written\n\nInside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated\nbefore the buffer is written, potentially causing race conditions where\nthe host sees an updated read pointer before the buffer is actually\nwritten. Updating rd_offset prematurely can lead to the host accessing\nan uninitialized or incomplete element, resulting in data corruption.\n\nInvoke the buffer write before updating rd_offset to ensure the element\nis fully written before signaling its availability." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bus: mhi: ep: Actualizar el puntero de lectura solo despu\u00e9s de escribir en el b\u00fafer. Dentro de mhi_ep_ring_add_element, el puntero de lectura (rd_offset) se actualiza antes de escribir en el b\u00fafer, lo que podr\u00eda causar condiciones de ejecuci\u00f3n donde el host ve un puntero de lectura actualizado antes de que se escriba en el b\u00fafer. Actualizar rd_offset prematuramente puede provocar que el host acceda a un elemento no inicializado o incompleto, lo que resulta en corrupci\u00f3n de datos. Invoque la escritura en el b\u00fafer antes de actualizar rd_offset para garantizar que el elemento est\u00e9 completamente escrito antes de indicar su disponibilidad." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38430.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38430.json index 4e3d56b3d9f..91aa42920f6 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38430.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38430.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: nfsd4_spo_must_allow() must check this is a v4 compound request\n\nIf the request being processed is not a v4 compound request, then\nexamining the cstate can have undefined results.\n\nThis patch adds a check that the rpc procedure being executed\n(rq_procinfo) is the NFSPROC4_COMPOUND procedure." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfsd: nfsd4_spo_must_allow() debe comprobar que se trata de una solicitud compuesta v4. Si la solicitud que se est\u00e1 procesando no es una solicitud compuesta v4, examinar el estado de ejecuci\u00f3n (cstate) puede tener resultados indefinidos. Este parche a\u00f1ade una comprobaci\u00f3n de que el procedimiento rpc en ejecuci\u00f3n (rq_procinfo) es el procedimiento NFSPROC4_COMPOUND." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38431.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38431.json index 4c2065c38b8..68c79602179 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38431.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38431.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix regression with native SMB symlinks\n\nSome users and customers reported that their backup/copy tools started\nto fail when the directory being copied contained symlink targets that\nthe client couldn't parse - even when those symlinks weren't followed.\n\nFix this by allowing lstat(2) and readlink(2) to succeed even when the\nclient can't resolve the symlink target, restoring old behavior." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb: cliente: corregir regresi\u00f3n con enlaces simb\u00f3licos SMB nativos. Algunos usuarios y clientes informaron que sus herramientas de copia de seguridad/copia comenzaban a fallar cuando el directorio copiado conten\u00eda enlaces simb\u00f3licos que el cliente no pod\u00eda analizar, incluso si no se segu\u00edan. Para solucionar esto, permita que lstat(2) y readlink(2) funcionen correctamente incluso cuando el cliente no pueda resolver el enlace simb\u00f3lico, restaurando as\u00ed el comportamiento anterior." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38432.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38432.json index 828d798d408..aa5bfe42c7f 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38432.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38432.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: netpoll: Initialize UDP checksum field before checksumming\n\ncommit f1fce08e63fe (\"netpoll: Eliminate redundant assignment\") removed\nthe initialization of the UDP checksum, which was wrong and broke\nnetpoll IPv6 transmission due to bad checksumming.\n\nudph->check needs to be set before calling csum_ipv6_magic()." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: netpoll: Inicializar el campo de suma de comprobaci\u00f3n UDP antes del commit de suma de comprobaci\u00f3n f1fce08e63fe (\"netpoll: Eliminar la asignaci\u00f3n redundante\") elimin\u00f3 la inicializaci\u00f3n de la suma de comprobaci\u00f3n UDP, lo cual era incorrecto y rompi\u00f3 la transmisi\u00f3n IPv6 de netpoll debido a una suma de comprobaci\u00f3n incorrecta. udph->check debe configurarse antes de llamar a csum_ipv6_magic()." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38433.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38433.json index de92f00edd3..d8d8915a59c 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38433.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38433.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: fix runtime constant support for nommu kernels\n\nthe `__runtime_fixup_32` function does not handle the case where `val` is\nzero correctly (as might occur when patching a nommu kernel and referring\nto a physical address below the 4GiB boundary whose upper 32 bits are all\nzero) because nothing in the existing logic prevents the code from taking\nthe `else` branch of both nop-checks and emitting two `nop` instructions.\n\nThis leaves random garbage in the register that is supposed to receive the\nupper 32 bits of the pointer instead of zero that when combined with the\nvalue for the lower 32 bits yields an invalid pointer and causes a kernel\npanic when that pointer is eventually accessed.\n\nThe author clearly considered the fact that if the `lui` is converted into\na `nop` that the second instruction needs to be adjusted to become an `li`\ninstead of an `addi`, hence introducing the `addi_insn_mask` variable, but\ndidn't follow that logic through fully to the case where the `else` branch\nexecutes. To fix it just adjust the logic to ensure that the second `else`\nbranch is not taken if the first instruction will be patched to a `nop`." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: se corrige el soporte de constantes de tiempo de ejecuci\u00f3n para kernels nommu la funci\u00f3n `__runtime_fixup_32` no maneja el caso donde `val` es cero correctamente (como podr\u00eda ocurrir al parchar un kernel nommu y hacer referencia a una direcci\u00f3n f\u00edsica por debajo del l\u00edmite de 4GiB cuyos 32 bits superiores son todos cero) porque nada en la l\u00f3gica existente evita que el c\u00f3digo tome la rama `else` de ambos nop-checks y emita dos instrucciones `nop`. Esto deja basura aleatoria en el registro que se supone que recibe los 32 bits superiores del puntero en lugar de cero que, cuando se combina con el valor de los 32 bits inferiores, produce un puntero no v\u00e1lido y causa un p\u00e1nico del kernel cuando finalmente se accede a ese puntero. El autor consider\u00f3 claramente que si la instrucci\u00f3n `lui` se convierte en `nop`, la segunda instrucci\u00f3n debe ajustarse para que se convierta en `li` en lugar de `addi`, introduciendo as\u00ed la variable `addi_insn_mask`. Sin embargo, no sigui\u00f3 esta l\u00f3gica completamente hasta el caso en que se ejecuta la rama `else`. Para solucionarlo, simplemente ajuste la l\u00f3gica para garantizar que la segunda rama `else` no se ejecute si la primera instrucci\u00f3n se convierte en `nop`." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38434.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38434.json index 7f9c10b8f56..40c4d74a795 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38434.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38434.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"riscv: Define TASK_SIZE_MAX for __access_ok()\"\n\nThis reverts commit ad5643cf2f69 (\"riscv: Define TASK_SIZE_MAX for\n__access_ok()\").\n\nThis commit changes TASK_SIZE_MAX to be LONG_MAX to optimize access_ok(),\nbecause the previous TASK_SIZE_MAX (default to TASK_SIZE) requires some\ncomputation.\n\nThe reasoning was that all user addresses are less than LONG_MAX, and all\nkernel addresses are greater than LONG_MAX. Therefore access_ok() can\nfilter kernel addresses.\n\nAddresses between TASK_SIZE and LONG_MAX are not valid user addresses, but\naccess_ok() let them pass. That was thought to be okay, because they are\nnot valid addresses at hardware level.\n\nUnfortunately, one case is missed: get_user_pages_fast() happily accepts\naddresses between TASK_SIZE and LONG_MAX. futex(), for instance, uses\nget_user_pages_fast(). This causes the problem reported by Robert [1].\n\nTherefore, revert this commit. TASK_SIZE_MAX is changed to the default:\nTASK_SIZE.\n\nThis unfortunately reduces performance, because TASK_SIZE is more expensive\nto compute compared to LONG_MAX. But correctness first, we can think about\noptimization later, if required." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Revertir \"riscv: Define TASK_SIZE_MAX for __access_ok()\". Esto revierte el commit ad5643cf2f69 (\"riscv: Define TASK_SIZE_MAX for __access_ok()\"). Este commit cambia TASK_SIZE_MAX a LONG_MAX para optimizar access_ok(), ya que el valor predeterminado de TASK_SIZE_MAX (predeterminado) requiere c\u00e1lculos. El razonamiento era que todas las direcciones de usuario son menores que LONG_MAX y todas las direcciones de kernel son mayores que LONG_MAX. Por lo tanto, access_ok() puede filtrar direcciones de kernel. Las direcciones entre TASK_SIZE y LONG_MAX no son direcciones de usuario v\u00e1lidas, pero access_ok() las deja pasar. Se consider\u00f3 que esto era correcto, ya que no son direcciones v\u00e1lidas a nivel de hardware. Desafortunadamente, se omite un caso: get_user_pages_fast() acepta direcciones entre TASK_SIZE y LONG_MAX. futex(), por ejemplo, usa get_user_pages_fast(). Esto causa el problema reportado por Robert [1]. Por lo tanto, revierte este commit . TASK_SIZE_MAX se cambia al valor predeterminado: TASK_SIZE. Lamentablemente, esto reduce el rendimiento, ya que TASK_SIZE es m\u00e1s costoso de calcular que LONG_MAX. Pero primero la correcci\u00f3n; podemos pensar en la optimizaci\u00f3n m\u00e1s adelante, si es necesario." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38435.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38435.json index 5ead66ac685..b53cca2565c 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38435.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38435.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: vector: Fix context save/restore with xtheadvector\n\nPreviously only v0-v7 were correctly saved/restored,\nand the context of v8-v31 are damanged.\nCorrectly save/restore v8-v31 to avoid breaking userspace." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: vector: Se corrige el guardado/restauraci\u00f3n de contexto con xtheadvector. Anteriormente, solo se guardaban/restauraban correctamente las versiones v0 a v7, y el contexto de las versiones v8 a v31 estaba da\u00f1ado. Guarde/restaure correctamente las versiones v8 a v31 para evitar la interrupci\u00f3n del espacio de usuario." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-384xx/CVE-2025-38436.json b/CVE-2025/CVE-2025-384xx/CVE-2025-38436.json index 8711abba29f..91f0b37feaf 100644 --- a/CVE-2025/CVE-2025-384xx/CVE-2025-38436.json +++ b/CVE-2025/CVE-2025-384xx/CVE-2025-38436.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/scheduler: signal scheduled fence when kill job\n\nWhen an entity from application B is killed, drm_sched_entity_kill()\nremoves all jobs belonging to that entity through\ndrm_sched_entity_kill_jobs_work(). If application A's job depends on a\nscheduled fence from application B's job, and that fence is not properly\nsignaled during the killing process, application A's dependency cannot be\ncleared.\n\nThis leads to application A hanging indefinitely while waiting for a\ndependency that will never be resolved. Fix this issue by ensuring that\nscheduled fences are properly signaled when an entity is killed, allowing\ndependent applications to continue execution." + }, + { + "lang": "es", + "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/scheduler: se\u00f1al de valla programada al finalizar un trabajo. Cuando se finaliza una entidad de la aplicaci\u00f3n B, drm_sched_entity_kill() elimina todos los trabajos pertenecientes a esa entidad mediante drm_sched_entity_kill_jobs_work(). Si el trabajo de la aplicaci\u00f3n A depende de una valla programada del trabajo de la aplicaci\u00f3n B, y dicha valla no se se\u00f1aliza correctamente durante el proceso de finalizaci\u00f3n, no se puede eliminar la dependencia de la aplicaci\u00f3n A. Esto provoca que la aplicaci\u00f3n A se cuelgue indefinidamente mientras espera una dependencia que nunca se resolver\u00e1. Solucione este problema asegur\u00e1ndose de que las vallas programadas se se\u00f1alicen correctamente cuando se finaliza una entidad, lo que permite que las aplicaciones dependientes contin\u00faen su ejecuci\u00f3n." } ], "metrics": {}, diff --git a/CVE-2025/CVE-2025-39xx/CVE-2025-3910.json b/CVE-2025/CVE-2025-39xx/CVE-2025-3910.json index 0bd1807f7b3..2b4d24c01d8 100644 --- a/CVE-2025/CVE-2025-39xx/CVE-2025-3910.json +++ b/CVE-2025/CVE-2025-39xx/CVE-2025-3910.json @@ -3,7 +3,7 @@ "sourceIdentifier": "secalert@redhat.com", "published": "2025-04-29T21:15:51.707", "lastModified": "2025-07-28T13:15:29.193", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-405xx/CVE-2025-40596.json b/CVE-2025/CVE-2025-405xx/CVE-2025-40596.json index 18b7b6679bf..14b7b8994a1 100644 --- a/CVE-2025/CVE-2025-405xx/CVE-2025-40596.json +++ b/CVE-2025/CVE-2025-405xx/CVE-2025-40596.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution." + }, + { + "lang": "es", + "value": "Una vulnerabilidad de desbordamiento de b\u00fafer basada en pila en la interfaz web de la serie SMA100 permite que un atacante remoto no autenticado provoque una denegaci\u00f3n de servicio (DoS) o potencialmente resulte en la ejecuci\u00f3n de c\u00f3digo." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-405xx/CVE-2025-40597.json b/CVE-2025/CVE-2025-405xx/CVE-2025-40597.json index 34c620b6439..db4cdbfe7c4 100644 --- a/CVE-2025/CVE-2025-405xx/CVE-2025-40597.json +++ b/CVE-2025/CVE-2025-405xx/CVE-2025-40597.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution." + }, + { + "lang": "es", + "value": "Una vulnerabilidad de desbordamiento de b\u00fafer basada en mont\u00f3n en la interfaz web de la serie SMA100 permite que un atacante remoto no autenticado provoque una denegaci\u00f3n de servicio (DoS) o potencialmente resulte en la ejecuci\u00f3n de c\u00f3digo." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-405xx/CVE-2025-40599.json b/CVE-2025/CVE-2025-405xx/CVE-2025-40599.json index 4a1399b460a..98630002b3f 100644 --- a/CVE-2025/CVE-2025-405xx/CVE-2025-40599.json +++ b/CVE-2025/CVE-2025-405xx/CVE-2025-40599.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de carga arbitraria de archivos autenticados en la interfaz de administraci\u00f3n web de la serie SMA 100. Un atacante remoto con privilegios administrativos puede explotar esta vulnerabilidad para cargar archivos arbitrarios al sistema, lo que podr\u00eda provocar la ejecuci\u00f3n remota de c\u00f3digo." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-406xx/CVE-2025-40680.json b/CVE-2025/CVE-2025-406xx/CVE-2025-40680.json index 11b92989e7a..13929795174 100644 --- a/CVE-2025/CVE-2025-406xx/CVE-2025-40680.json +++ b/CVE-2025/CVE-2025-406xx/CVE-2025-40680.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and the JWT session token in plain text within different registry keys on the Windows operating system. Any authenticated local user with read access to the registry can extract these sensitive values." + }, + { + "lang": "es", + "value": "Falta de cifrado de datos confidenciales en CapillaryScope v2.5.0 de Capillary io, que almacena tanto las credenciales del proxy como el token de sesi\u00f3n JWT en texto plano dentro de diferentes claves de registro en el sistema operativo Windows. Cualquier usuario local autenticado con acceso de lectura al registro puede extraer estos valores confidenciales." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-406xx/CVE-2025-40682.json b/CVE-2025/CVE-2025-406xx/CVE-2025-40682.json index ac0a16b483b..fe793a56450 100644 --- a/CVE-2025/CVE-2025-406xx/CVE-2025-40682.json +++ b/CVE-2025/CVE-2025-406xx/CVE-2025-40682.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve-coordination@incibe.es", "published": "2025-07-29T13:15:26.107", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the \u201ccity\u201d and \u201cstate\u201d parameters in the /controller/ccity.php endpoint." + }, + { + "lang": "es", + "value": "Vulnerabilidad de inyecci\u00f3n SQL en Human Resource Management System version 1.0, que permite a un atacante recuperar, crear, actualizar y eliminar bases de datos a trav\u00e9s de los par\u00e1metros \u201ccity\u201d y \u201cstate\u201d en el endpoint /controller/ccity.php." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-406xx/CVE-2025-40683.json b/CVE-2025/CVE-2025-406xx/CVE-2025-40683.json index 7496c4387c9..9449a77bed2 100644 --- a/CVE-2025/CVE-2025-406xx/CVE-2025-40683.json +++ b/CVE-2025/CVE-2025-406xx/CVE-2025-40683.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve-coordination@incibe.es", "published": "2025-07-29T13:15:26.317", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the\u00a0'searccity' parameter in /city.php." + }, + { + "lang": "es", + "value": "Se detect\u00f3 un ataque de Cross-Site Scripting (XSS) reflejado en Human Resource Management System version 1.0. Esta vulnerabilidad podr\u00eda permitir que un atacante ejecute c\u00f3digo JavaScript en el navegador de la v\u00edctima enviando una URL maliciosa a trav\u00e9s del par\u00e1metro \"searccity\" en /city.php." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-406xx/CVE-2025-40684.json b/CVE-2025/CVE-2025-406xx/CVE-2025-40684.json index dcf4ab759a8..2e790c06385 100644 --- a/CVE-2025/CVE-2025-406xx/CVE-2025-40684.json +++ b/CVE-2025/CVE-2025-406xx/CVE-2025-40684.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve-coordination@incibe.es", "published": "2025-07-29T13:15:26.730", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the\u00a0'searccountry' parameter in/country.php." + }, + { + "lang": "es", + "value": "Se detect\u00f3 un ataque de Cross-Site Scripting (XSS) reflejado en Human Resource Management System version 1.0. Esta vulnerabilidad podr\u00eda permitir que un atacante ejecute c\u00f3digo JavaScript en el navegador de la v\u00edctima enviando una URL maliciosa a trav\u00e9s del par\u00e1metro \"searccountry\" en/country.php." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-406xx/CVE-2025-40685.json b/CVE-2025/CVE-2025-406xx/CVE-2025-40685.json index 81a305af622..91018f715de 100644 --- a/CVE-2025/CVE-2025-406xx/CVE-2025-40685.json +++ b/CVE-2025/CVE-2025-406xx/CVE-2025-40685.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve-coordination@incibe.es", "published": "2025-07-29T13:15:26.897", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the\u00a0'searcstate' parameter in/state.php." + }, + { + "lang": "es", + "value": "Se detect\u00f3 un ataque de Cross-Site Scripting (XSS) reflejado en Human Resource Management System version 1.0. Esta vulnerabilidad podr\u00eda permitir que un atacante ejecute c\u00f3digo JavaScript en el navegador de la v\u00edctima enviando una URL maliciosa a trav\u00e9s del par\u00e1metro \"searcstate\" en/state.php." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-406xx/CVE-2025-40686.json b/CVE-2025/CVE-2025-406xx/CVE-2025-40686.json index 2f12a1adb5a..0fc093eca48 100644 --- a/CVE-2025/CVE-2025-406xx/CVE-2025-40686.json +++ b/CVE-2025/CVE-2025-406xx/CVE-2025-40686.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve-coordination@incibe.es", "published": "2025-07-29T13:15:27.050", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the\u00a0'employeeid' parameter in/detailview.php." + }, + { + "lang": "es", + "value": "Cross-Site Scripting (XSS) reflejado en Human Resource Management System version 1.0. Esta vulnerabilidad podr\u00eda permitir que un atacante ejecute c\u00f3digo JavaScript en el navegador de la v\u00edctima enviando una URL maliciosa a trav\u00e9s del par\u00e1metro 'employeeid' en/detailview.php." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-412xx/CVE-2025-41240.json b/CVE-2025/CVE-2025-412xx/CVE-2025-41240.json index 850bbaeecc9..7872827074e 100644 --- a/CVE-2025/CVE-2025-412xx/CVE-2025-41240.json +++ b/CVE-2025/CVE-2025-412xx/CVE-2025-41240.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located within the web server document root.\nIn affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remote attacker could retrieve these secrets by accessing specific URLs if the application is exposed externally. The issue affects deployments using the default value of usePasswordFiles=true, which mounts secrets as files into the container filesystem." + }, + { + "lang": "es", + "value": "Three Bitnami Helm charts montan secretos de Kubernetes en una ruta predecible (/opt/bitnami/*/secrets) ubicada en el root de documentos del servidor web. En las versiones afectadas, esto puede provocar acceso no autenticado a credenciales confidenciales mediante HTTP/S. Un atacante remoto podr\u00eda obtener estos secretos accediendo a URL espec\u00edficas si la aplicaci\u00f3n est\u00e1 expuesta externamente. El problema afecta a las implementaciones que utilizan el valor predeterminado usePasswordFiles=true, que monta los secretos como archivos en el sistema de archivos del contenedor." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-412xx/CVE-2025-41241.json b/CVE-2025/CVE-2025-412xx/CVE-2025-41241.json index 9bee9c8c718..fdcd724dd20 100644 --- a/CVE-2025/CVE-2025-412xx/CVE-2025-41241.json +++ b/CVE-2025/CVE-2025-412xx/CVE-2025-41241.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "VMware vCenter contains a denial-of-service vulnerability.\u00a0A malicious actor who is authenticated through vCenter and has permission to perform API calls for guest OS customisation may trigger this vulnerability to create a denial-of-service condition." + }, + { + "lang": "es", + "value": "VMware vCenter contiene una vulnerabilidad de denegaci\u00f3n de servicio. Un agente malicioso autenticado a trav\u00e9s de vCenter y con permiso para realizar llamadas a la API para la personalizaci\u00f3n del sistema operativo invitado podr\u00eda activar esta vulnerabilidad y crear una condici\u00f3n de denegaci\u00f3n de servicio." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-413xx/CVE-2025-41391.json b/CVE-2025/CVE-2025-413xx/CVE-2025-41391.json index 4730e762d68..ae10f396b90 100644 --- a/CVE-2025/CVE-2025-413xx/CVE-2025-41391.json +++ b/CVE-2025/CVE-2025-413xx/CVE-2025-41391.json @@ -3,7 +3,7 @@ "sourceIdentifier": "vultures@jpcert.or.jp", "published": "2025-07-31T08:15:24.807", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-413xx/CVE-2025-41396.json b/CVE-2025/CVE-2025-413xx/CVE-2025-41396.json index 8bac98987dd..b2d6a4f9b88 100644 --- a/CVE-2025/CVE-2025-413xx/CVE-2025-41396.json +++ b/CVE-2025/CVE-2025-413xx/CVE-2025-41396.json @@ -3,7 +3,7 @@ "sourceIdentifier": "vultures@jpcert.or.jp", "published": "2025-07-31T08:15:24.973", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-414xx/CVE-2025-41420.json b/CVE-2025/CVE-2025-414xx/CVE-2025-41420.json index 0d42002f1d0..d8fb0fe96de 100644 --- a/CVE-2025/CVE-2025-414xx/CVE-2025-41420.json +++ b/CVE-2025/CVE-2025-414xx/CVE-2025-41420.json @@ -3,12 +3,16 @@ "sourceIdentifier": "talos-cna@cisco.com", "published": "2025-07-24T16:15:31.317", "lastModified": "2025-07-25T15:29:19.837", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de cross-site scripting (xss) en la funci\u00f3n del par\u00e1metro userLogin cancelUri de WWBN AVideo 14.4 y el commit de desarrollo principal 8a8954ff. Una solicitud HTTP especialmente manipulada puede provocar la ejecuci\u00f3n arbitraria de JavaScript. Un atacante puede hacer que un usuario visite una p\u00e1gina web para activar esta vulnerabilidad." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-416xx/CVE-2025-41683.json b/CVE-2025/CVE-2025-416xx/CVE-2025-41683.json index 84f5719f626..386b7adf53b 100644 --- a/CVE-2025/CVE-2025-416xx/CVE-2025-41683.json +++ b/CVE-2025/CVE-2025-416xx/CVE-2025-41683.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint event_mail_test)." + }, + { + "lang": "es", + "value": "Un atacante remoto autenticado puede ejecutar comandos arbitrarios con privilegios de root en los dispositivos afectados debido a la falta de depuraci\u00f3n inadecuada de la entrada del usuario en la interfaz web principal (endpoint event_mail_test)." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-416xx/CVE-2025-41684.json b/CVE-2025/CVE-2025-416xx/CVE-2025-41684.json index e1de0182a2f..60f97038146 100644 --- a/CVE-2025/CVE-2025-416xx/CVE-2025-41684.json +++ b/CVE-2025/CVE-2025-416xx/CVE-2025-41684.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint tls_iotgen_setting)." + }, + { + "lang": "es", + "value": "Un atacante remoto autenticado puede ejecutar comandos arbitrarios con privilegios de root en los dispositivos afectados debido a la falta de depuraci\u00f3n inadecuada de la entrada del usuario en la interfaz web principal (endpoint tls_iotgen_setting)." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-416xx/CVE-2025-41687.json b/CVE-2025/CVE-2025-416xx/CVE-2025-41687.json index 266cadecdcc..de327df421f 100644 --- a/CVE-2025/CVE-2025-416xx/CVE-2025-41687.json +++ b/CVE-2025/CVE-2025-416xx/CVE-2025-41687.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An unauthenticated remote attacker may use a stack based buffer overflow in the u-link Management API to gain full access on the affected devices." + }, + { + "lang": "es", + "value": "Un atacante remoto no autenticado puede usar un desbordamiento de b\u00fafer basado en pila en la API de administraci\u00f3n de u-link para obtener acceso completo a los dispositivos afectados." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-42xx/CVE-2025-4296.json b/CVE-2025/CVE-2025-42xx/CVE-2025-4296.json index c63c31b818f..33f7b076072 100644 --- a/CVE-2025/CVE-2025-42xx/CVE-2025-4296.json +++ b/CVE-2025/CVE-2025-42xx/CVE-2025-4296.json @@ -16,6 +16,10 @@ { "lang": "en", "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HotelRunner B2B allows Forceful Browsing.This issue affects B2B: before 04.06.2025." + }, + { + "lang": "es", + "value": "La vulnerabilidad de redirecci\u00f3n de URL a un sitio no confiable ('Open Redirect') en HotelRunner B2B permite una navegaci\u00f3n forzada. Este problema afecta a B2B: antes del 04.06.2025." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-437xx/CVE-2025-43712.json b/CVE-2025/CVE-2025-437xx/CVE-2025-43712.json index 42cd6d3e479..c646ee467e1 100644 --- a/CVE-2025/CVE-2025-437xx/CVE-2025-43712.json +++ b/CVE-2025/CVE-2025-437xx/CVE-2025-43712.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-25T13:15:29.927", "lastModified": "2025-07-28T17:15:29.783", - "vulnStatus": "Undergoing Analysis", + "vulnStatus": "Awaiting Analysis", "cveTags": [ { "sourceIdentifier": "cve@mitre.org", @@ -16,6 +16,10 @@ { "lang": "en", "value": "JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard user, the authorities parameter in the response from the api/account endpoint contains the value ROLE_USER. By manipulating the authorities parameter and changing its value to ROLE_ADMIN, the privilege is successfully escalated to an Admin level. This allowed the access to all admin-related functionalities in the application. NOTE: this is disputed by the Supplier because there is no privilege escalation in the context of the JHipster backend (the report only demonstrates that, after using JHipster to generate an application, one can make a non-functional admin screen visible in the front end of that application)." + }, + { + "lang": "es", + "value": "Las versiones anteriores a la versi\u00f3n 8.9.0 de JHipster permiten la escalada de privilegios mediante un par\u00e1metro de autoridad modificado. Al registrarse en el portal de JHipster e iniciar sesi\u00f3n como usuario est\u00e1ndar, el par\u00e1metro de autoridad en la respuesta del endpoint de la API/cuenta contiene el valor ROLE_USER. Al manipular el par\u00e1metro de autoridad y cambiar su valor a ROLE_ADMIN, el privilegio se escala correctamente a nivel de administrador. Esto permite el acceso a todas las funciones administrativas de la aplicaci\u00f3n." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-437xx/CVE-2025-43720.json b/CVE-2025/CVE-2025-437xx/CVE-2025-43720.json index 322511577f3..3d9089b374c 100644 --- a/CVE-2025/CVE-2025-437xx/CVE-2025-43720.json +++ b/CVE-2025/CVE-2025-437xx/CVE-2025-43720.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T17:15:37.050", "lastModified": "2025-07-22T14:15:34.060", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-439xx/CVE-2025-43976.json b/CVE-2025/CVE-2025-439xx/CVE-2025-43976.json index 56b4c898267..cc467ae8925 100644 --- a/CVE-2025/CVE-2025-439xx/CVE-2025-43976.json +++ b/CVE-2025/CVE-2025-439xx/CVE-2025-43976.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T15:15:27.203", "lastModified": "2025-07-22T16:15:27.517", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-439xx/CVE-2025-43977.json b/CVE-2025/CVE-2025-439xx/CVE-2025-43977.json index 43134bb9b12..c589666a0f7 100644 --- a/CVE-2025/CVE-2025-439xx/CVE-2025-43977.json +++ b/CVE-2025/CVE-2025-439xx/CVE-2025-43977.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T15:15:27.550", "lastModified": "2025-07-22T16:15:27.733", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-43xx/CVE-2025-4393.json b/CVE-2025/CVE-2025-43xx/CVE-2025-4393.json index 6dc72006871..cdb3421cf76 100644 --- a/CVE-2025/CVE-2025-43xx/CVE-2025-4393.json +++ b/CVE-2025/CVE-2025-43xx/CVE-2025-4393.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the service by crafting a binary payload to crash the service or elevate privileges. \n\nThis issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025" + }, + { + "lang": "es", + "value": "Medtronic MyCareLink Patient Monitor cuenta con un servicio interno que deserializa datos, lo que permite a un atacante local interactuar con el servicio mediante la manipulado de una carga binaria para bloquearlo o elevar privilegios. Este problema afecta a los modelos 24950 y 24952 de Medtronic MyCareLink Patient Monitor antes del 25 de junio de 2025." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-43xx/CVE-2025-4394.json b/CVE-2025/CVE-2025-43xx/CVE-2025-4394.json index bec96976e28..d3576cf8b9f 100644 --- a/CVE-2025/CVE-2025-43xx/CVE-2025-4394.json +++ b/CVE-2025/CVE-2025-43xx/CVE-2025-4394.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files. \n\nThis issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025" + }, + { + "lang": "es", + "value": "Medtronic MyCareLink Patient Monitor utiliza un sistema de archivos sin cifrar en el almacenamiento interno, lo que permite a un atacante con acceso f\u00edsico leer y modificar archivos. Este problema afecta a los modelos 24950 y 24952 de Medtronic MyCareLink Patient Monitor antes del 25 de junio de 2025." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-43xx/CVE-2025-4395.json b/CVE-2025/CVE-2025-43xx/CVE-2025-4395.json index 2c730fb6cca..bd36cc0d886 100644 --- a/CVE-2025/CVE-2025-43xx/CVE-2025-4395.json +++ b/CVE-2025/CVE-2025-43xx/CVE-2025-4395.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system functionality. \n\nThis issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025" + }, + { + "lang": "es", + "value": "Medtronic MyCareLink Patient Monitor tiene una cuenta de usuario integrada con una contrase\u00f1a vac\u00eda, lo que permite a un atacante con acceso f\u00edsico iniciar sesi\u00f3n sin contrase\u00f1a y modificar las funciones del sistema. Este problema afecta a los modelos 24950 y 24952 deMedtronic MyCareLink Patient Monitor antes del 25 de junio de 2025." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-441xx/CVE-2025-44109.json b/CVE-2025/CVE-2025-441xx/CVE-2025-44109.json index 5dd977012ca..6c432e556cb 100644 --- a/CVE-2025/CVE-2025-441xx/CVE-2025-44109.json +++ b/CVE-2025/CVE-2025-441xx/CVE-2025-44109.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages." + }, + { + "lang": "es", + "value": "Una redirecci\u00f3n de URL en Pinokio v3.6.23 permite a los atacantes redirigir a los usuarios v\u00edctimas a p\u00e1ginas controladas por los atacantes." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-446xx/CVE-2025-44608.json b/CVE-2025/CVE-2025-446xx/CVE-2025-44608.json index a8812465a49..82841a12caf 100644 --- a/CVE-2025/CVE-2025-446xx/CVE-2025-44608.json +++ b/CVE-2025/CVE-2025-446xx/CVE-2025-44608.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-25T15:15:29.130", "lastModified": "2025-07-25T21:15:26.143", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 que CloudClassroom-PHP Project v1.0 conten\u00eda una vulnerabilidad de inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro viewid." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-446xx/CVE-2025-44647.json b/CVE-2025/CVE-2025-446xx/CVE-2025-44647.json index c6391143dd0..3be97f23d6c 100644 --- a/CVE-2025/CVE-2025-446xx/CVE-2025-44647.json +++ b/CVE-2025/CVE-2025-446xx/CVE-2025-44647.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T16:15:28.963", "lastModified": "2025-07-22T16:15:27.953", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-446xx/CVE-2025-44650.json b/CVE-2025/CVE-2025-446xx/CVE-2025-44650.json index 9d7682b104b..d4d2f5c026a 100644 --- a/CVE-2025/CVE-2025-446xx/CVE-2025-44650.json +++ b/CVE-2025/CVE-2025-446xx/CVE-2025-44650.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T16:15:29.090", "lastModified": "2025-07-22T16:15:28.177", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-446xx/CVE-2025-44651.json b/CVE-2025/CVE-2025-446xx/CVE-2025-44651.json index b77f355b868..409a5f198aa 100644 --- a/CVE-2025/CVE-2025-446xx/CVE-2025-44651.json +++ b/CVE-2025/CVE-2025-446xx/CVE-2025-44651.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T16:15:29.207", "lastModified": "2025-07-22T16:15:28.480", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-446xx/CVE-2025-44655.json b/CVE-2025/CVE-2025-446xx/CVE-2025-44655.json index db952c93c8a..b08913891d2 100644 --- a/CVE-2025/CVE-2025-446xx/CVE-2025-44655.json +++ b/CVE-2025/CVE-2025-446xx/CVE-2025-44655.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T16:15:29.323", "lastModified": "2025-07-22T19:15:24.930", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-446xx/CVE-2025-44657.json b/CVE-2025/CVE-2025-446xx/CVE-2025-44657.json index c0af97dc70e..c14c00d7c8e 100644 --- a/CVE-2025/CVE-2025-446xx/CVE-2025-44657.json +++ b/CVE-2025/CVE-2025-446xx/CVE-2025-44657.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T16:15:29.443", "lastModified": "2025-07-22T16:15:28.720", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-446xx/CVE-2025-44658.json b/CVE-2025/CVE-2025-446xx/CVE-2025-44658.json index fdf845f4672..bb41728721e 100644 --- a/CVE-2025/CVE-2025-446xx/CVE-2025-44658.json +++ b/CVE-2025/CVE-2025-446xx/CVE-2025-44658.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T16:15:29.560", "lastModified": "2025-07-22T20:15:25.203", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-44xx/CVE-2025-4411.json b/CVE-2025/CVE-2025-44xx/CVE-2025-4411.json index fe81040a653..65ed4f5a892 100644 --- a/CVE-2025/CVE-2025-44xx/CVE-2025-4411.json +++ b/CVE-2025/CVE-2025-44xx/CVE-2025-4411.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dataprom Informatics PACS-ACSS allows Cross-Site Scripting (XSS).This issue affects PACS-ACSS: before 16.05.2025." + }, + { + "lang": "es", + "value": "La vulnerabilidad de neutralizaci\u00f3n incorrecta de la entrada durante la generaci\u00f3n de p\u00e1ginas web (XSS o 'Cross-site Scripting') en PACS-ACSS de Dataprom Informatics permite Cross-Site Scripting (XSS). Este problema afecta a PACS-ACSS: antes del 16.05.2025." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-44xx/CVE-2025-4439.json b/CVE-2025/CVE-2025-44xx/CVE-2025-4439.json index 35601442905..22861ae23d8 100644 --- a/CVE-2025/CVE-2025-44xx/CVE-2025-4439.json +++ b/CVE-2025/CVE-2025-44xx/CVE-2025-4439.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an authenticated user to perform cross-site scripting attacks when the instance is served through certain content delivery networks." + }, + { + "lang": "es", + "value": "Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 15.10 hasta la 18.0.5, la 18.1 hasta la 18.1.3 y la 18.2 hasta la 18.2.1 que podr\u00eda haber permitido que un usuario autenticado realizara ataques de cross-site scripting cuando la instancia se sirve a trav\u00e9s de determinadas redes de distribuci\u00f3n de contenido." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-44xx/CVE-2025-4478.json b/CVE-2025/CVE-2025-44xx/CVE-2025-4478.json index 69a8c0f7955..8c5808a4b08 100644 --- a/CVE-2025/CVE-2025-44xx/CVE-2025-4478.json +++ b/CVE-2025/CVE-2025-44xx/CVE-2025-4478.json @@ -3,7 +3,7 @@ "sourceIdentifier": "secalert@redhat.com", "published": "2025-05-16T15:15:48.630", "lastModified": "2025-07-29T19:15:46.473", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-454xx/CVE-2025-45467.json b/CVE-2025/CVE-2025-454xx/CVE-2025-45467.json index ccc62d050d0..fcc3939db08 100644 --- a/CVE-2025/CVE-2025-454xx/CVE-2025-45467.json +++ b/CVE-2025/CVE-2025-454xx/CVE-2025-45467.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an insecure verification mechanism that solely relies on MD5 checksums for firmware integrity validation." + }, + { + "lang": "es", + "value": "Unitree Go1 <= Go1_2022_05_11 es vulnerable a permisos inseguros ya que la funcionalidad de actualizaci\u00f3n de firmware (a trav\u00e9s de Wi-Fi/Ethernet) implementa un mecanismo de verificaci\u00f3n inseguro que se basa \u00fanicamente en sumas de comprobaci\u00f3n MD5 para la validaci\u00f3n de la integridad del firmware." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-457xx/CVE-2025-45702.json b/CVE-2025/CVE-2025-457xx/CVE-2025-45702.json index 03f688b9e66..5b624495159 100644 --- a/CVE-2025/CVE-2025-457xx/CVE-2025-45702.json +++ b/CVE-2025/CVE-2025-457xx/CVE-2025-45702.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "SoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 que SoftPerfect Pty Ltd Connection Quality Monitor v1.1 almacena todas las credenciales en texto sin formato." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-457xx/CVE-2025-45768.json b/CVE-2025/CVE-2025-457xx/CVE-2025-45768.json index c082786433a..817b3242378 100644 --- a/CVE-2025/CVE-2025-457xx/CVE-2025-45768.json +++ b/CVE-2025/CVE-2025-457xx/CVE-2025-45768.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "pyjwt v2.10.1 was discovered to contain weak encryption." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 que pyjwt v2.10.1 conten\u00eda un cifrado d\u00e9bil." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-457xx/CVE-2025-45769.json b/CVE-2025/CVE-2025-457xx/CVE-2025-45769.json index ae0be19b303..a13f8ea8af7 100644 --- a/CVE-2025/CVE-2025-457xx/CVE-2025-45769.json +++ b/CVE-2025/CVE-2025-457xx/CVE-2025-45769.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "php-jwt v6.11.0 was discovered to contain weak encryption." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 que php-jwt v6.11.0 conten\u00eda un cifrado d\u00e9bil." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-457xx/CVE-2025-45770.json b/CVE-2025/CVE-2025-457xx/CVE-2025-45770.json index 75b363f7caf..9ea0bc62ce7 100644 --- a/CVE-2025/CVE-2025-457xx/CVE-2025-45770.json +++ b/CVE-2025/CVE-2025-457xx/CVE-2025-45770.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "jwt v5.4.3 was discovered to contain weak encryption." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 que jwt v5.4.3 conten\u00eda un cifrado d\u00e9bil." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-457xx/CVE-2025-45777.json b/CVE-2025/CVE-2025-457xx/CVE-2025-45777.json index 7031d7db22e..477cdab99c4 100644 --- a/CVE-2025/CVE-2025-457xx/CVE-2025-45777.json +++ b/CVE-2025/CVE-2025-457xx/CVE-2025-45777.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An issue in the OTP mechanism of Chavara Family Welfare Centre Chavara Matrimony Site v2.0 allows attackers to bypass authentication via supplying a crafted request." + }, + { + "lang": "es", + "value": "Un problema en el mecanismo OTP de Chavara Family Welfare Centre Chavara Matrimony Site v2.0 permite a los atacantes eludir la autenticaci\u00f3n mediante el suministro de una solicitud manipulada espec\u00edficamente para ello." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-458xx/CVE-2025-45892.json b/CVE-2025/CVE-2025-458xx/CVE-2025-45892.json index 1d018de76c7..c1f0098e3b0 100644 --- a/CVE-2025/CVE-2025-458xx/CVE-2025-45892.json +++ b/CVE-2025/CVE-2025-458xx/CVE-2025-45892.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-25T17:15:32.350", "lastModified": "2025-07-29T14:14:55.157", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-458xx/CVE-2025-45893.json b/CVE-2025/CVE-2025-458xx/CVE-2025-45893.json index e488b44f669..2b10c7b77d5 100644 --- a/CVE-2025/CVE-2025-458xx/CVE-2025-45893.json +++ b/CVE-2025/CVE-2025-458xx/CVE-2025-45893.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-25T17:15:32.520", "lastModified": "2025-07-29T14:14:55.157", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-459xx/CVE-2025-45939.json b/CVE-2025/CVE-2025-459xx/CVE-2025-45939.json index 907b86a1929..0e4507e9732 100644 --- a/CVE-2025/CVE-2025-459xx/CVE-2025-45939.json +++ b/CVE-2025/CVE-2025-459xx/CVE-2025-45939.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Apwide Golive 10.2.0 Jira plugin allows Server-Side Request Forgery (SSRF) via the test webhook function." + }, + { + "lang": "es", + "value": "El complemento Apwide Golive 10.2.0 Jira permite Server-Side Request Forgery (SSRF) a trav\u00e9s de la funci\u00f3n de webhook de prueba." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-45xx/CVE-2025-4523.json b/CVE-2025/CVE-2025-45xx/CVE-2025-4523.json index ee3c531db1a..1215a25466c 100644 --- a/CVE-2025/CVE-2025-45xx/CVE-2025-4523.json +++ b/CVE-2025/CVE-2025-45xx/CVE-2025-4523.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "The IDonate \u2013 Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view() function in versions 2.0.0 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose an administrator\u2019s username, email address, and all donor fields." + }, + { + "lang": "es", + "value": "El complemento IDonate \u2013 Blood Donation, Request And Donor Management System para WordPress es vulnerable al acceso no autorizado a los datos debido a la falta de una comprobaci\u00f3n de capacidad en la funci\u00f3n admin_donor_profile_view() en las versiones 2.0.0 a 2.1.9. Esto permite que atacantes autenticados, con acceso de suscriptor o superior, expongan el nombre de usuario, la direcci\u00f3n de correo electr\u00f3nico y todos los campos de donantes de un administrador." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-460xx/CVE-2025-46099.json b/CVE-2025/CVE-2025-460xx/CVE-2025-46099.json index c4bd0c1d0b6..4130abf2088 100644 --- a/CVE-2025/CVE-2025-460xx/CVE-2025-46099.json +++ b/CVE-2025/CVE-2025-460xx/CVE-2025-46099.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter." + }, + { + "lang": "es", + "value": "En Pluck CMS 4.7.20-dev, un atacante autenticado puede cargar o manipular un archivo PHP manipulado en el directorio del m\u00f3dulo de \u00e1lbumes y acceder a \u00e9l a trav\u00e9s de la l\u00f3gica de enrutamiento del m\u00f3dulo en albums.site.php, lo que da como resultado la ejecuci\u00f3n de un comando arbitrario a trav\u00e9s de un par\u00e1metro GET." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-461xx/CVE-2025-46116.json b/CVE-2025/CVE-2025-461xx/CVE-2025-46116.json index cb0bba9cfb2..1b8dea54999 100644 --- a/CVE-2025/CVE-2025-461xx/CVE-2025-46116.json +++ b/CVE-2025/CVE-2025-461xx/CVE-2025-46116.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T15:15:27.690", "lastModified": "2025-07-22T17:15:30.797", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-461xx/CVE-2025-46117.json b/CVE-2025/CVE-2025-461xx/CVE-2025-46117.json index 8673c3034eb..576032b6184 100644 --- a/CVE-2025/CVE-2025-461xx/CVE-2025-46117.json +++ b/CVE-2025/CVE-2025-461xx/CVE-2025-46117.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T15:15:27.823", "lastModified": "2025-07-23T18:15:26.903", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-461xx/CVE-2025-46118.json b/CVE-2025/CVE-2025-461xx/CVE-2025-46118.json index be65ee41453..097141690c6 100644 --- a/CVE-2025/CVE-2025-461xx/CVE-2025-46118.json +++ b/CVE-2025/CVE-2025-461xx/CVE-2025-46118.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T15:15:27.940", "lastModified": "2025-07-28T20:17:46.840", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-461xx/CVE-2025-46119.json b/CVE-2025/CVE-2025-461xx/CVE-2025-46119.json index fdf9e3b26de..6fa757d23c6 100644 --- a/CVE-2025/CVE-2025-461xx/CVE-2025-46119.json +++ b/CVE-2025/CVE-2025-461xx/CVE-2025-46119.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T15:15:28.047", "lastModified": "2025-07-22T18:15:35.857", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-461xx/CVE-2025-46120.json b/CVE-2025/CVE-2025-461xx/CVE-2025-46120.json index 01ad097f79b..9ac08ced16c 100644 --- a/CVE-2025/CVE-2025-461xx/CVE-2025-46120.json +++ b/CVE-2025/CVE-2025-461xx/CVE-2025-46120.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T15:15:28.157", "lastModified": "2025-07-23T18:15:27.263", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-461xx/CVE-2025-46121.json b/CVE-2025/CVE-2025-461xx/CVE-2025-46121.json index 1d0ecd2d51f..e0b3cff59b2 100644 --- a/CVE-2025/CVE-2025-461xx/CVE-2025-46121.json +++ b/CVE-2025/CVE-2025-461xx/CVE-2025-46121.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T15:15:28.270", "lastModified": "2025-07-25T14:15:34.307", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-461xx/CVE-2025-46122.json b/CVE-2025/CVE-2025-461xx/CVE-2025-46122.json index 1a2af372188..2fe64c5a6cc 100644 --- a/CVE-2025/CVE-2025-461xx/CVE-2025-46122.json +++ b/CVE-2025/CVE-2025-461xx/CVE-2025-46122.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T15:15:28.390", "lastModified": "2025-07-23T18:15:27.433", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-461xx/CVE-2025-46123.json b/CVE-2025/CVE-2025-461xx/CVE-2025-46123.json index 60959e35ebe..281eebf6724 100644 --- a/CVE-2025/CVE-2025-461xx/CVE-2025-46123.json +++ b/CVE-2025/CVE-2025-461xx/CVE-2025-46123.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T15:15:28.500", "lastModified": "2025-07-24T21:15:51.747", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-463xx/CVE-2025-46359.json b/CVE-2025/CVE-2025-463xx/CVE-2025-46359.json index f9cd4ecb336..f7ea0e4e10e 100644 --- a/CVE-2025/CVE-2025-463xx/CVE-2025-46359.json +++ b/CVE-2025/CVE-2025-463xx/CVE-2025-46359.json @@ -3,7 +3,7 @@ "sourceIdentifier": "vultures@jpcert.or.jp", "published": "2025-07-31T08:15:25.140", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-466xx/CVE-2025-46686.json b/CVE-2025/CVE-2025-466xx/CVE-2025-46686.json index 800b0cb9ca8..bfa95aac42b 100644 --- a/CVE-2025/CVE-2025-466xx/CVE-2025-46686.json +++ b/CVE-2025/CVE-2025-466xx/CVE-2025-46686.json @@ -16,6 +16,10 @@ { "lang": "en", "value": "Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this is disputed by the Supplier because abuse of the commands network protocol is not a violation of the Redis Security Model." + }, + { + "lang": "es", + "value": "Redis, hasta la versi\u00f3n 7.4.3, permite el consumo de memoria mediante un comando multibulk compuesto por varios lotes, enviado por un usuario autenticado. Esto ocurre porque el servidor asigna memoria para los argumentos de cada lote, incluso si el comando se omite por falta de permisos." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-467xx/CVE-2025-46713.json b/CVE-2025/CVE-2025-467xx/CVE-2025-46713.json index 22ebcf61976..35d960f6038 100644 --- a/CVE-2025/CVE-2025-467xx/CVE-2025-46713.json +++ b/CVE-2025/CVE-2025-467xx/CVE-2025-46713.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-05-22T13:15:57.650", "lastModified": "2025-05-23T15:55:02.040", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-467xx/CVE-2025-46714.json b/CVE-2025/CVE-2025-467xx/CVE-2025-46714.json index 0bbfe5eaaf9..cb79c4fe67a 100644 --- a/CVE-2025/CVE-2025-467xx/CVE-2025-46714.json +++ b/CVE-2025/CVE-2025-467xx/CVE-2025-46714.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-05-22T13:15:57.913", "lastModified": "2025-05-23T15:55:02.040", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-467xx/CVE-2025-46715.json b/CVE-2025/CVE-2025-467xx/CVE-2025-46715.json index f7b8ec3161c..60e8f61a899 100644 --- a/CVE-2025/CVE-2025-467xx/CVE-2025-46715.json +++ b/CVE-2025/CVE-2025-467xx/CVE-2025-46715.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-05-22T17:15:24.400", "lastModified": "2025-05-23T15:55:02.040", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-467xx/CVE-2025-46716.json b/CVE-2025/CVE-2025-467xx/CVE-2025-46716.json index d1620f7847f..32dee5e0bf6 100644 --- a/CVE-2025/CVE-2025-467xx/CVE-2025-46716.json +++ b/CVE-2025/CVE-2025-467xx/CVE-2025-46716.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-05-22T17:15:24.560", "lastModified": "2025-05-23T15:55:02.040", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-467xx/CVE-2025-46725.json b/CVE-2025/CVE-2025-467xx/CVE-2025-46725.json index efb947149d5..bbb3f185518 100644 --- a/CVE-2025/CVE-2025-467xx/CVE-2025-46725.json +++ b/CVE-2025/CVE-2025-467xx/CVE-2025-46725.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-05-20T18:15:46.580", "lastModified": "2025-05-21T20:24:58.133", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-467xx/CVE-2025-46732.json b/CVE-2025/CVE-2025-467xx/CVE-2025-46732.json index 3b1956b9cad..3639e9d7b03 100644 --- a/CVE-2025/CVE-2025-467xx/CVE-2025-46732.json +++ b/CVE-2025/CVE-2025-467xx/CVE-2025-46732.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-07-18T15:15:27.200", "lastModified": "2025-07-22T13:06:27.983", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-467xx/CVE-2025-46788.json b/CVE-2025/CVE-2025-467xx/CVE-2025-46788.json index 98723bc1c66..a56cbbad50a 100644 --- a/CVE-2025/CVE-2025-467xx/CVE-2025-46788.json +++ b/CVE-2025/CVE-2025-467xx/CVE-2025-46788.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2025-07-10T16:15:24.050", "lastModified": "2025-07-15T13:24:41.097", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-467xx/CVE-2025-46789.json b/CVE-2025/CVE-2025-467xx/CVE-2025-46789.json index 5ffe495c108..e259e2f3c06 100644 --- a/CVE-2025/CVE-2025-467xx/CVE-2025-46789.json +++ b/CVE-2025/CVE-2025-467xx/CVE-2025-46789.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2025-07-10T16:15:24.573", "lastModified": "2025-07-15T13:24:41.097", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-468xx/CVE-2025-46809.json b/CVE-2025/CVE-2025-468xx/CVE-2025-46809.json index 02e2467cf9d..0953f53062c 100644 --- a/CVE-2025/CVE-2025-468xx/CVE-2025-46809.json +++ b/CVE-2025/CVE-2025-468xx/CVE-2025-46809.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A Insertion of Sensitive Information into Log File vulnerability in SUSE Multi Linux Manager exposes the HTTP proxy credentials.\u00a0This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2." + }, + { + "lang": "es", + "value": "Una vulnerabilidad de inserci\u00f3n de informaci\u00f3n confidencial en el archivo de registro en SUSE Multi Linux Manager expone las credenciales del proxy HTTP. Este problema afecta al contenedor suse/manager/5.0/x86_64/server:5.0.5.7.30.1: de ? anterior a 5.0.27-150600.3.33.1; imagen SLES15-SP4-Manager-Server-4-3-BYOS: de ? anterior a 4.3.87-150400.3.110.2; imagen SLES15-SP4-Manager-Server-4-3-BYOS-Azure: de ? anterior a 4.3.87-150400.3.110.2; imagen SLES15-SP4-Manager-Server-4-3-BYOS-EC2: de ? anterior a 4.3.87-150400.3.110.2; Imagen SLES15-SP4-Manager-Server-4-3-BYOS-GCE: desde ? anterior a 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: desde ? anterior a 4.3.87-150400.3.110.2." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-469xx/CVE-2025-46993.json b/CVE-2025/CVE-2025-469xx/CVE-2025-46993.json index c5db31abf04..edd9cfd5271 100644 --- a/CVE-2025/CVE-2025-469xx/CVE-2025-46993.json +++ b/CVE-2025/CVE-2025-469xx/CVE-2025-46993.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field." + }, + { + "lang": "es", + "value": "Las versiones 6.5.22 y anteriores de Adobe Experience Manager se ven afectadas por una vulnerabilidad de Cross-Site Scripting (XSS) Almacenado que un atacante con pocos privilegios podr\u00eda aprovechar para inyectar scripts maliciosos en campos de formulario vulnerables. Es posible que se ejecute JavaScript malicioso en el navegador de la v\u00edctima al acceder a la p\u00e1gina que contiene el campo vulnerable." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-469xx/CVE-2025-46996.json b/CVE-2025/CVE-2025-469xx/CVE-2025-46996.json index 7177023a865..51d249f57a1 100644 --- a/CVE-2025/CVE-2025-469xx/CVE-2025-46996.json +++ b/CVE-2025/CVE-2025-469xx/CVE-2025-46996.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field." + }, + { + "lang": "es", + "value": "Las versiones 6.5.22 y anteriores de Adobe Experience Manager se ven afectadas por una vulnerabilidad de Cross-Site Scripting (XSS) Almacenado que un atacante con pocos privilegios podr\u00eda aprovechar para inyectar scripts maliciosos en campos de formulario vulnerables. Es posible que se ejecute JavaScript malicioso en el navegador de la v\u00edctima al acceder a la p\u00e1gina que contiene el campo vulnerable." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-46xx/CVE-2025-4608.json b/CVE-2025/CVE-2025-46xx/CVE-2025-4608.json index 5c84ab65d10..955b3871f45 100644 --- a/CVE-2025/CVE-2025-46xx/CVE-2025-4608.json +++ b/CVE-2025/CVE-2025-46xx/CVE-2025-4608.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "The Structured Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_business shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page." + }, + { + "lang": "es", + "value": "El complemento de Structured Content para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del shortcode sc_fs_local_business del complemento en todas las versiones hasta la 1.6.4 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-470xx/CVE-2025-47001.json b/CVE-2025/CVE-2025-470xx/CVE-2025-47001.json index fac35f7bcc2..2541df3cc49 100644 --- a/CVE-2025/CVE-2025-470xx/CVE-2025-47001.json +++ b/CVE-2025/CVE-2025-470xx/CVE-2025-47001.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@adobe.com", "published": "2025-07-30T13:15:33.190", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-470xx/CVE-2025-47061.json b/CVE-2025/CVE-2025-470xx/CVE-2025-47061.json index 86ff23857b0..858c9a3b1a2 100644 --- a/CVE-2025/CVE-2025-470xx/CVE-2025-47061.json +++ b/CVE-2025/CVE-2025-470xx/CVE-2025-47061.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field." + }, + { + "lang": "es", + "value": "Las versiones 6.5.22 y anteriores de Adobe Experience Manager se ven afectadas por una vulnerabilidad de Cross-Site Scripting (XSS) Almacenado que un atacante con pocos privilegios podr\u00eda aprovechar para inyectar scripts maliciosos en campos de formulario vulnerables. Es posible que se ejecute JavaScript malicioso en el navegador de la v\u00edctima al acceder a la p\u00e1gina que contiene el campo vulnerable." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-472xx/CVE-2025-47281.json b/CVE-2025/CVE-2025-472xx/CVE-2025-47281.json index 2e462a7425b..6371014e5af 100644 --- a/CVE-2025/CVE-2025-472xx/CVE-2025-47281.json +++ b/CVE-2025/CVE-2025-472xx/CVE-2025-47281.json @@ -3,12 +3,16 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-07-23T21:15:26.397", "lastModified": "2025-07-25T15:29:44.523", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft expressions using the {{@}} variable combined with a pipe and an invalid JMESPath function (e.g., {{@ | non_existent_function }}). This leads to a nil value being substituted into the policy structure. Subsequent processing by internal functions, specifically getValueAsStringMap, which expect string values, results in a panic due to a type assertion failure (interface {} is nil, not string). This crashes Kyverno worker threads in the admission controller and causes continuous crashes of the reports controller pod. This is fixed in version 1.14.2." + }, + { + "lang": "es", + "value": "Kyverno es un motor de pol\u00edticas dise\u00f1ado para equipos de ingenier\u00eda de plataformas nativas de la nube. En las versiones 1.14.1 y anteriores, existe una vulnerabilidad de denegaci\u00f3n de servicio (DoS) debido al manejo inadecuado de las sustituciones de variables JMESPath. Los atacantes con permisos para crear o actualizar pol\u00edticas de Kyverno pueden manipular expresiones utilizando la variable {{@}} combinada con una barra vertical y una funci\u00f3n JMESPath no v\u00e1lida (p. ej., {{@ | non_existent_function }}). Esto provoca la sustituci\u00f3n de un valor nulo en la estructura de la pol\u00edtica. El procesamiento posterior por funciones internas, en concreto getValueAsStringMap, que esperan valores de cadena, genera un p\u00e1nico debido a un error en la aserci\u00f3n de tipo (la interfaz {} es nula, no de cadena). Esto bloquea los subprocesos de trabajo de Kyverno en el controlador de admisi\u00f3n y provoca bloqueos continuos del pod del controlador de informes. Esto se ha corregido en la versi\u00f3n 1.14.2." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-477xx/CVE-2025-47711.json b/CVE-2025/CVE-2025-477xx/CVE-2025-47711.json index 37301eae084..9a30a00858a 100644 --- a/CVE-2025/CVE-2025-477xx/CVE-2025-47711.json +++ b/CVE-2025/CVE-2025-477xx/CVE-2025-47711.json @@ -19,7 +19,7 @@ "cvssMetricV31": [ { "source": "secalert@redhat.com", - "type": "Primary", + "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", @@ -42,7 +42,7 @@ "weaknesses": [ { "source": "secalert@redhat.com", - "type": "Primary", + "type": "Secondary", "description": [ { "lang": "en", diff --git a/CVE-2025/CVE-2025-479xx/CVE-2025-47917.json b/CVE-2025/CVE-2025-479xx/CVE-2025-47917.json index cbb053c01a3..cfe4196e033 100644 --- a/CVE-2025/CVE-2025-479xx/CVE-2025-47917.json +++ b/CVE-2025/CVE-2025-479xx/CVE-2025-47917.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-20T19:15:23.847", "lastModified": "2025-07-22T13:06:07.260", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-479xx/CVE-2025-47950.json b/CVE-2025/CVE-2025-479xx/CVE-2025-47950.json index 35bc168a474..90dd5e9f999 100644 --- a/CVE-2025/CVE-2025-479xx/CVE-2025-47950.json +++ b/CVE-2025/CVE-2025-479xx/CVE-2025-47950.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-06-06T18:15:35.330", "lastModified": "2025-06-09T12:15:47.880", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-47xx/CVE-2025-4700.json b/CVE-2025/CVE-2025-47xx/CVE-2025-4700.json index 75acbe73175..770513d3ff7 100644 --- a/CVE-2025/CVE-2025-47xx/CVE-2025-4700.json +++ b/CVE-2025/CVE-2025-47xx/CVE-2025-4700.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering leading to XSS." + }, + { + "lang": "es", + "value": "Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 15.10 hasta la 18.0.5, la 18.1 hasta la 18.1.3 y la 18.2 hasta la 18.2.1 que, en circunstancias espec\u00edficas, podr\u00eda haber permitido que un atacante exitoso desencadenara una representaci\u00f3n de contenido no deseada que condujera a XSS." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-47xx/CVE-2025-4784.json b/CVE-2025/CVE-2025-47xx/CVE-2025-4784.json index f3abe786b39..2e15fe8fe64 100644 --- a/CVE-2025/CVE-2025-47xx/CVE-2025-4784.json +++ b/CVE-2025/CVE-2025-47xx/CVE-2025-4784.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "La vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando SQL ('Inyecci\u00f3n SQL') en Moderec Tourtella permite la inyecci\u00f3n SQL. Este problema afecta a Tourtella: antes del 26.05.2025." + "value": "La vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando SQL ('SQL Injection') en Moderec Tourtella permite la inyecci\u00f3n SQL. Este problema afecta a Tourtella: antes del 26.05.2025." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-480xx/CVE-2025-48067.json b/CVE-2025/CVE-2025-480xx/CVE-2025-48067.json index effba6b010b..c6664d965d7 100644 --- a/CVE-2025/CVE-2025-480xx/CVE-2025-48067.json +++ b/CVE-2025/CVE-2025-480xx/CVE-2025-48067.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-06-10T16:15:41.357", "lastModified": "2025-06-12T16:06:39.330", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-480xx/CVE-2025-48071.json b/CVE-2025/CVE-2025-480xx/CVE-2025-48071.json index 1cab0094c6d..a7b44d0d0dd 100644 --- a/CVE-2025/CVE-2025-480xx/CVE-2025-48071.json +++ b/CVE-2025/CVE-2025-480xx/CVE-2025-48071.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.2 through 3.3.0, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep scan-line EXR files with a maliciously forged chunk header. This is fixed in version 3.3.3." + }, + { + "lang": "es", + "value": "OpenEXR proporciona la especificaci\u00f3n y la implementaci\u00f3n de referencia del formato de archivo EXR, un formato de almacenamiento de im\u00e1genes para la industria cinematogr\u00e1fica. En las versiones 3.3.2 a 3.3.0, se produce un desbordamiento de b\u00fafer en el mont\u00f3n durante una operaci\u00f3n de escritura al descomprimir archivos EXR de l\u00ednea de escaneo profundo comprimidos en ZIPS con un encabezado de fragmento falsificado maliciosamente. Esto se solucion\u00f3 en la versi\u00f3n 3.3.3." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-480xx/CVE-2025-48072.json b/CVE-2025/CVE-2025-480xx/CVE-2025-48072.json index 1610ec5314c..86e6fb291e9 100644 --- a/CVE-2025/CVE-2025-480xx/CVE-2025-48072.json +++ b/CVE-2025/CVE-2025-480xx/CVE-2025-48072.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3." + }, + { + "lang": "es", + "value": "OpenEXR proporciona la especificaci\u00f3n y la implementaci\u00f3n de referencia del formato de archivo EXR, un formato de almacenamiento de im\u00e1genes para la industria cinematogr\u00e1fica. La versi\u00f3n 3.3.2 es vulnerable a un desbordamiento de b\u00fafer basado en el mont\u00f3n durante una operaci\u00f3n de lectura debido a un c\u00e1lculo incorrecto del puntero al descomprimir archivos EXR de l\u00ednea de escaneo empaquetados con DWAA con un fragmento falsificado maliciosamente. Esto se corrige en la versi\u00f3n 3.3.3." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-480xx/CVE-2025-48073.json b/CVE-2025/CVE-2025-480xx/CVE-2025-48073.json index 8ad7ecb97f0..76bebaad1c6 100644 --- a/CVE-2025/CVE-2025-480xx/CVE-2025-48073.json +++ b/CVE-2025/CVE-2025-480xx/CVE-2025-48073.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereference in a write operation. This is fixed in version 3.3.3." + }, + { + "lang": "es", + "value": "OpenEXR proporciona la especificaci\u00f3n y la implementaci\u00f3n de referencia del formato de archivo EXR, un formato de almacenamiento de im\u00e1genes para la industria cinematogr\u00e1fica. En la versi\u00f3n 3.3.2, al leer una imagen de l\u00ednea de escaneo profundo con un gran n\u00famero de muestras en modo reduceMemory, es posible que la aplicaci\u00f3n de destino se bloquee con una desreferencia de puntero NULL en una operaci\u00f3n de escritura. Esto se solucion\u00f3 en la versi\u00f3n 3.3.3." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-488xx/CVE-2025-48879.json b/CVE-2025/CVE-2025-488xx/CVE-2025-48879.json index 01542e6d568..e43ec9a6a15 100644 --- a/CVE-2025/CVE-2025-488xx/CVE-2025-48879.json +++ b/CVE-2025/CVE-2025-488xx/CVE-2025-48879.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-06-10T16:15:41.513", "lastModified": "2025-06-12T16:06:39.330", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-489xx/CVE-2025-48950.json b/CVE-2025/CVE-2025-489xx/CVE-2025-48950.json index 51218c772a3..cd44181f94b 100644 --- a/CVE-2025/CVE-2025-489xx/CVE-2025-48950.json +++ b/CVE-2025/CVE-2025-489xx/CVE-2025-48950.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-06-03T19:15:39.230", "lastModified": "2025-06-04T14:54:33.783", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-489xx/CVE-2025-48952.json b/CVE-2025/CVE-2025-489xx/CVE-2025-48952.json index 0800622d446..b57430c1bf3 100644 --- a/CVE-2025/CVE-2025-489xx/CVE-2025-48952.json +++ b/CVE-2025/CVE-2025-489xx/CVE-2025-48952.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-07-04T23:15:21.760", "lastModified": "2025-07-08T16:18:53.607", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-489xx/CVE-2025-48965.json b/CVE-2025/CVE-2025-489xx/CVE-2025-48965.json index 460c4ed4880..3b0d177dfe0 100644 --- a/CVE-2025/CVE-2025-489xx/CVE-2025-48965.json +++ b/CVE-2025/CVE-2025-489xx/CVE-2025-48965.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-20T18:15:22.950", "lastModified": "2025-07-22T13:06:07.260", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-48xx/CVE-2025-4822.json b/CVE-2025/CVE-2025-48xx/CVE-2025-4822.json index 2087bab27c8..942498e1c1a 100644 --- a/CVE-2025/CVE-2025-48xx/CVE-2025-4822.json +++ b/CVE-2025/CVE-2025-48xx/CVE-2025-4822.json @@ -16,6 +16,10 @@ { "lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bayraktar Solar Energies ScadaWatt Otopilot allows SQL Injection.This issue affects ScadaWatt Otopilot: before 27.05.2025." + }, + { + "lang": "es", + "value": "Vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando SQL ('SQL Injection') en Bayraktar Solar Energies ScadaWatt Otopilot permite la inyecci\u00f3n SQL. Este problema afecta a ScadaWatt Otopilot: antes del 27.05.2025." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-490xx/CVE-2025-49082.json b/CVE-2025/CVE-2025-490xx/CVE-2025-49082.json index f4aba1ba0d5..928597f4b62 100644 --- a/CVE-2025/CVE-2025-490xx/CVE-2025-49082.json +++ b/CVE-2025/CVE-2025-490xx/CVE-2025-49082.json @@ -3,7 +3,7 @@ "sourceIdentifier": "SecurityResponse@netmotionsoftware.com", "published": "2025-07-31T00:15:26.783", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-490xx/CVE-2025-49083.json b/CVE-2025/CVE-2025-490xx/CVE-2025-49083.json index 6cbaa6f095c..a9e9b66abc4 100644 --- a/CVE-2025/CVE-2025-490xx/CVE-2025-49083.json +++ b/CVE-2025/CVE-2025-490xx/CVE-2025-49083.json @@ -3,7 +3,7 @@ "sourceIdentifier": "SecurityResponse@netmotionsoftware.com", "published": "2025-07-31T00:15:26.957", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-490xx/CVE-2025-49084.json b/CVE-2025/CVE-2025-490xx/CVE-2025-49084.json index 7589c096e6d..3e91ffe9d5a 100644 --- a/CVE-2025/CVE-2025-490xx/CVE-2025-49084.json +++ b/CVE-2025/CVE-2025-490xx/CVE-2025-49084.json @@ -3,7 +3,7 @@ "sourceIdentifier": "SecurityResponse@netmotionsoftware.com", "published": "2025-07-31T00:15:27.113", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-490xx/CVE-2025-49087.json b/CVE-2025/CVE-2025-490xx/CVE-2025-49087.json index bad5dbed5f1..3130b3ede05 100644 --- a/CVE-2025/CVE-2025-490xx/CVE-2025-49087.json +++ b/CVE-2025/CVE-2025-490xx/CVE-2025-49087.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-20T19:15:24.037", "lastModified": "2025-07-22T13:06:07.260", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-494xx/CVE-2025-49462.json b/CVE-2025/CVE-2025-494xx/CVE-2025-49462.json index e87ae67f8c3..475f9508cd7 100644 --- a/CVE-2025/CVE-2025-494xx/CVE-2025-49462.json +++ b/CVE-2025/CVE-2025-494xx/CVE-2025-49462.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2025-07-10T17:15:47.590", "lastModified": "2025-07-15T13:24:41.097", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-494xx/CVE-2025-49463.json b/CVE-2025/CVE-2025-494xx/CVE-2025-49463.json index bd5ca5abc0a..613e2609151 100644 --- a/CVE-2025/CVE-2025-494xx/CVE-2025-49463.json +++ b/CVE-2025/CVE-2025-494xx/CVE-2025-49463.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2025-07-10T17:15:47.747", "lastModified": "2025-07-15T13:24:41.097", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-494xx/CVE-2025-49464.json b/CVE-2025/CVE-2025-494xx/CVE-2025-49464.json index a1f04650665..43482158761 100644 --- a/CVE-2025/CVE-2025-494xx/CVE-2025-49464.json +++ b/CVE-2025/CVE-2025-494xx/CVE-2025-49464.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@zoom.us", "published": "2025-07-10T17:15:47.897", "lastModified": "2025-07-15T13:24:41.097", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-495xx/CVE-2025-49590.json b/CVE-2025/CVE-2025-495xx/CVE-2025-49590.json index 898f813a32f..0a3cecab7e0 100644 --- a/CVE-2025/CVE-2025-495xx/CVE-2025-49590.json +++ b/CVE-2025/CVE-2025-495xx/CVE-2025-49590.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-06-18T23:15:19.200", "lastModified": "2025-06-23T20:16:59.783", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-495xx/CVE-2025-49591.json b/CVE-2025/CVE-2025-495xx/CVE-2025-49591.json index 5fc59352b75..501c8bcf571 100644 --- a/CVE-2025/CVE-2025-495xx/CVE-2025-49591.json +++ b/CVE-2025/CVE-2025-495xx/CVE-2025-49591.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-06-18T23:15:19.403", "lastModified": "2025-06-23T20:16:59.783", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-49xx/CVE-2025-4968.json b/CVE-2025/CVE-2025-49xx/CVE-2025-4968.json index ecefde5fc14..7b389322eb4 100644 --- a/CVE-2025/CVE-2025-49xx/CVE-2025-4968.json +++ b/CVE-2025/CVE-2025-49xx/CVE-2025-4968.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Page Builder elements (Copyright Element, Hover Box, Separator With Text, FAQ, Single Image, Custom Header, Button, Call To Action, Progress Bar, Pie Chart, Round Chart, and Line Chart) in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page." + }, + { + "lang": "es", + "value": "El complemento WPBakery Page Builder para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s de varios elementos del Page Builder (elemento de copyright, cuadro flotante, separador con texto, preguntas frecuentes, imagen \u00fanica, encabezado personalizado, bot\u00f3n, llamada a la acci\u00f3n, barra de progreso, gr\u00e1fico circular, gr\u00e1fico circular y gr\u00e1fico de l\u00edneas) en todas las versiones hasta la 8.4.1 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-500xx/CVE-2025-50059.json b/CVE-2025/CVE-2025-500xx/CVE-2025-50059.json index c97c8b66309..0b7f56a3c86 100644 --- a/CVE-2025/CVE-2025-500xx/CVE-2025-50059.json +++ b/CVE-2025/CVE-2025-500xx/CVE-2025-50059.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Vulnerabilidad en Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: Redes). Las versiones compatibles afectadas son Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM para JDK: 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Esta vulnerabilidad, f\u00e1cilmente explotable, permite a un atacante no autenticado con acceso a la red a trav\u00e9s de m\u00faltiples protocolos comprometer Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition. Si bien la vulnerabilidad se encuentra en Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition, los ataques podr\u00edan afectar significativamente a otros productos (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a datos cr\u00edticos o acceso completo a todos los datos accesibles de Oracle Java SE, Oracle GraalVM for JDK y Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad se aplica a implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start o subprogramas Java en un entorno aislado, que cargan y ejecutan c\u00f3digo no confiable (p. ej., c\u00f3digo que proviene de internet) y dependen del entorno aislado de Java para su seguridad. Esta vulnerabilidad no se aplica a implementaciones de Java, generalmente en servidores, que cargan y ejecutan solo c\u00f3digo confiable (p. ej., c\u00f3digo instalado por un administrador). Puntuaci\u00f3n base de CVSS 3.1: 8.6 (Afecta a la confidencialidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)." + "value": "Vulnerabilidad en Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: Redes). Las versiones compatibles afectadas son Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM para JDK: 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Esta vulnerabilidad, f\u00e1cilmente explotable, permite a un atacante no autenticado con acceso a la red a trav\u00e9s de m\u00faltiples protocolos comprometer Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition. Si bien la vulnerabilidad se encuentra en Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition, los ataques podr\u00edan afectar significativamente a otros productos (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a datos cr\u00edticos o acceso completo a todos los datos accesibles de Oracle Java SE, Oracle GraalVM for JDK y Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad se aplica a implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start o subprogramas Java en un entorno de pruebas, que cargan y ejecutan c\u00f3digo no confiable (p. ej., c\u00f3digo que proviene de internet) y dependen del entorno de pruebas de Java para su seguridad. Esta vulnerabilidad no se aplica a implementaciones de Java, generalmente en servidores, que cargan y ejecutan solo c\u00f3digo confiable (p. ej., c\u00f3digo instalado por un administrador). Puntuaci\u00f3n base de CVSS 3.1: 8.6 (Afecta a la confidencialidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-501xx/CVE-2025-50106.json b/CVE-2025/CVE-2025-501xx/CVE-2025-50106.json index 909f11b91cd..4f526006648 100644 --- a/CVE-2025/CVE-2025-501xx/CVE-2025-50106.json +++ b/CVE-2025/CVE-2025-501xx/CVE-2025-50106.json @@ -12,7 +12,7 @@ }, { "lang": "es", - "value": "Vulnerabilidad en Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition (componente 2D). Las versiones compatibles afectadas son Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM para JDK: 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Esta vulnerabilidad, dif\u00edcil de explotar, permite que un atacante no autenticado con acceso a la red a trav\u00e9s de m\u00faltiples protocolos comprometa Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition. Los ataques con \u00e9xito a esta vulnerabilidad pueden resultar en la toma de control de Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad puede explotarse mediante el uso de las API en el componente especificado, por ejemplo, a trav\u00e9s de un servicio web que suministra datos a las API. Esta vulnerabilidad tambi\u00e9n afecta a implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start o applets Java en entornos aislados, que cargan y ejecutan c\u00f3digo no confiable (por ejemplo, c\u00f3digo proveniente de internet) y dependen del entorno aislado de Java para su seguridad. Puntuaci\u00f3n base de CVSS 3.1: 8.1 (Afecta a la confidencialidad, integridad y disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)." + "value": "Vulnerabilidad en Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition (componente 2D). Las versiones compatibles afectadas son Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM para JDK: 17.0.15, 21.0.7 y 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Esta vulnerabilidad, dif\u00edcil de explotar, permite que un atacante no autenticado con acceso a la red a trav\u00e9s de m\u00faltiples protocolos comprometa Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition. Los ataques con \u00e9xito a esta vulnerabilidad pueden resultar en la toma de control de Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad puede explotarse mediante el uso de las API en el componente especificado, por ejemplo, a trav\u00e9s de un servicio web que suministra datos a las API. Esta vulnerabilidad tambi\u00e9n afecta a implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start o applets Java en entornos aislados, que cargan y ejecutan c\u00f3digo no confiable (por ejemplo, c\u00f3digo proveniente de internet) y dependen del entorno de pruebas de Java para su seguridad. Puntuaci\u00f3n base de CVSS 3.1: 8.1 (Afecta a la confidencialidad, integridad y disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-501xx/CVE-2025-50127.json b/CVE-2025/CVE-2025-501xx/CVE-2025-50127.json index 7ef5d4ea012..26bb9b7aa20 100644 --- a/CVE-2025/CVE-2025-501xx/CVE-2025-50127.json +++ b/CVE-2025/CVE-2025-501xx/CVE-2025-50127.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL commands." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 una vulnerabilidad SQLi en el componente DJ-Flyer 1.0-3.2 para Joomla. El problema permite a usuarios con privilegios ejecutar comandos SQL arbitrarios." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-502xx/CVE-2025-50200.json b/CVE-2025/CVE-2025-502xx/CVE-2025-50200.json index 39dc0fe31ca..ef7c2433175 100644 --- a/CVE-2025/CVE-2025-502xx/CVE-2025-50200.json +++ b/CVE-2025/CVE-2025-502xx/CVE-2025-50200.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-06-19T17:15:26.123", "lastModified": "2025-06-23T20:16:59.783", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-502xx/CVE-2025-50270.json b/CVE-2025/CVE-2025-502xx/CVE-2025-50270.json index db129d19d3b..bfe48a7c62e 100644 --- a/CVE-2025/CVE-2025-502xx/CVE-2025-50270.json +++ b/CVE-2025/CVE-2025-502xx/CVE-2025-50270.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A stored Cross Site Scripting (xss) vulnerability in the \"content management\" feature in AnQiCMS v.3.4.11 allows a remote attacker to execute arbitrary code via a crafted script to the title, categoryTitle, and tmpTag parameters." + }, + { + "lang": "es", + "value": "Una vulnerabilidad de Cross-site Scripting (xss) almacenado en la funci\u00f3n de \"administraci\u00f3n de contenido\" en AnQiCMS v.3.4.11 permite a un atacante remoto ejecutar c\u00f3digo arbitrario a trav\u00e9s de un script manipulado para los par\u00e1metros title, categoryTitle y tmpTag." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-504xx/CVE-2025-50475.json b/CVE-2025/CVE-2025-504xx/CVE-2025-50475.json index 1d70d123564..36bf02af142 100644 --- a/CVE-2025/CVE-2025-504xx/CVE-2025-50475.json +++ b/CVE-2025/CVE-2025-504xx/CVE-2025-50475.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An OS command injection vulnerability exists in Russound MBX-PRE-D67F firmware version 3.1.6, allowing unauthenticated attackers to execute arbitrary commands as root via crafted input to the hostname parameter in network configuration requests. This vulnerability stems from improper neutralization of special elements used in an OS command within the network configuration handler, enabling remote code execution with the highest privileges." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en la versi\u00f3n 3.1.6 del firmware Russound MBX-PRE-D67F, que permite a atacantes no autenticados ejecutar comandos arbitrarios como root mediante una entrada manipulada en el par\u00e1metro hostname en las solicitudes de configuraci\u00f3n de red. Esta vulnerabilidad se deriva de la neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando del sistema operativo dentro del controlador de configuraci\u00f3n de red, lo que permite la ejecuci\u00f3n remota de c\u00f3digo con los privilegios m\u00e1s altos." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-504xx/CVE-2025-50477.json b/CVE-2025/CVE-2025-504xx/CVE-2025-50477.json index 37013af1682..ba087b3ee97 100644 --- a/CVE-2025/CVE-2025-504xx/CVE-2025-50477.json +++ b/CVE-2025/CVE-2025-504xx/CVE-2025-50477.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages." + }, + { + "lang": "es", + "value": "Una redirecci\u00f3n de URL en lbry-desktop v0.53.9 permite a los atacantes redirigir a los usuarios v\u00edctimas a p\u00e1ginas controladas por los atacantes." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-504xx/CVE-2025-50484.json b/CVE-2025/CVE-2025-504xx/CVE-2025-50484.json index 45e22e72d23..f2079324654 100644 --- a/CVE-2025/CVE-2025-504xx/CVE-2025-50484.json +++ b/CVE-2025/CVE-2025-504xx/CVE-2025-50484.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-28T19:15:42.810", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-505xx/CVE-2025-50572.json b/CVE-2025/CVE-2025-505xx/CVE-2025-50572.json index d2a5166e468..6e47cf579d3 100644 --- a/CVE-2025/CVE-2025-505xx/CVE-2025-50572.json +++ b/CVE-2025/CVE-2025-505xx/CVE-2025-50572.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An issue was discovered in Archer Technology RSA Archer 6.11.00204.10014 allowing attackers to execute arbitrary code via crafted system inputs that would be exported into the CSV and be executed after the user opened the file with compatible applications." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 un problema en Archer Technology RSA Archer 6.11.00204.10014 que permit\u00eda a los atacantes ejecutar c\u00f3digo arbitrario a trav\u00e9s de entradas de sistema manipuladas que se exportar\u00edan al CSV y se ejecutar\u00edan despu\u00e9s de que el usuario abriera el archivo con aplicaciones compatibles." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-508xx/CVE-2025-50847.json b/CVE-2025/CVE-2025-508xx/CVE-2025-50847.json index ee025d8c6a8..a9db7de1503 100644 --- a/CVE-2025/CVE-2025-508xx/CVE-2025-50847.json +++ b/CVE-2025/CVE-2025-508xx/CVE-2025-50847.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-31T16:15:30.683", "lastModified": "2025-07-31T20:15:43.710", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Cross Site Request Forgery (CSRF) vulnerability in CS Cart 4.18.3, allows attackers to add products to a user's comparison list via a crafted HTTP request." + }, + { + "lang": "es", + "value": "La vulnerabilidad de Cross Site Request Forgery (CSRF) en CS Cart 4.18.3 permite a los atacantes agregar productos a la lista de comparaci\u00f3n de un usuario a trav\u00e9s de una solicitud HTTP manipulada." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-508xx/CVE-2025-50848.json b/CVE-2025/CVE-2025-508xx/CVE-2025-50848.json index 8f9a8ee8f60..89a6a66a823 100644 --- a/CVE-2025/CVE-2025-508xx/CVE-2025-50848.json +++ b/CVE-2025/CVE-2025-508xx/CVE-2025-50848.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-31T16:15:30.843", "lastModified": "2025-07-31T20:15:43.913", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3 allows unrestricted upload of HTML files, which are rendered directly in the browser when accessed. This allows an attacker to upload a crafted HTML file containing malicious content, such as a fake login form for credential harvesting or scripts for Cross-Site Scripting (XSS) attacks. Since the content is served from a trusted domain, it significantly increases the likelihood of successful phishing or script execution against other users." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 una vulnerabilidad de carga de archivos en CS Cart 4.18.3 que permite a los atacantes ejecutar c\u00f3digo arbitrario. CS Cart 4.18.3 permite la carga sin restricciones de archivos HTML, que se muestran directamente en el navegador al acceder a ellos. Esto permite a un atacante cargar un archivo HTML manipulado con contenido malicioso, como un formulario de inicio de sesi\u00f3n falso para la recolecci\u00f3n de credenciales o scripts para ataques de Cross-site Scripting (XSS). Dado que el contenido se distribuye desde un dominio de confianza, aumenta significativamente la probabilidad de phishing o ejecuci\u00f3n de scripts contra otros usuarios." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-508xx/CVE-2025-50849.json b/CVE-2025/CVE-2025-508xx/CVE-2025-50849.json index 3237eaeebb2..0783d61ce1c 100644 --- a/CVE-2025/CVE-2025-508xx/CVE-2025-50849.json +++ b/CVE-2025/CVE-2025-508xx/CVE-2025-50849.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "CS Cart 4.18.3 is vulnerable to Insecure Direct Object Reference (IDOR). The user profile functionality allows enabling or disabling stickers through a parameter (company_id) sent in the request. However, this operation is not properly validated on the server side. An authenticated user can manipulate the request to target other users' accounts and toggle the sticker setting by modifying the company_id or other object identifiers." + }, + { + "lang": "es", + "value": "CS Cart 4.18.3 es vulnerable a la Referencia Directa a Objetos Insegura (IDOR). La funci\u00f3n de perfil de usuario permite habilitar o deshabilitar stickers mediante un par\u00e1metro (company_id) enviado en la solicitud. Sin embargo, esta operaci\u00f3n no se valida correctamente en el servidor. Un usuario autenticado puede manipular la solicitud para afectar las cuentas de otros usuarios y activar o desactivar la configuraci\u00f3n de stickers modificando el company_id u otros identificadores de objeto." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-508xx/CVE-2025-50850.json b/CVE-2025/CVE-2025-508xx/CVE-2025-50850.json index c5eba28d36f..782e3690c26 100644 --- a/CVE-2025/CVE-2025-508xx/CVE-2025-50850.json +++ b/CVE-2025/CVE-2025-508xx/CVE-2025-50850.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-31T16:15:31.163", "lastModified": "2025-07-31T20:15:45.067", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords (brute-force attack) to gain unauthorized access to vendor accounts. The absence of any blocking mechanism makes the login endpoint susceptible to automated attacks." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 un problema en CS Cart 4.18.3 que permite que la funci\u00f3n de inicio de sesi\u00f3n del proveedor carezca de controles de seguridad esenciales, como la verificaci\u00f3n CAPTCHA y la limitaci\u00f3n de velocidad. Esto permite que un atacante intente sistem\u00e1ticamente diversas combinaciones de nombres de usuario y contrase\u00f1as (ataque de fuerza bruta) para obtener acceso no autorizado a las cuentas del proveedor. La ausencia de cualquier mecanismo de bloqueo hace que el endpoint de inicio de sesi\u00f3n sea vulnerable a ataques automatizados." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-508xx/CVE-2025-50866.json b/CVE-2025/CVE-2025-508xx/CVE-2025-50866.json index 395fe760130..366f5bc7366 100644 --- a/CVE-2025/CVE-2025-508xx/CVE-2025-50866.json +++ b/CVE-2025/CVE-2025-508xx/CVE-2025-50866.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-31T17:15:30.200", "lastModified": "2025-07-31T21:15:28.500", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of the postquerypublic endpoint. Improper sanitization allows an attacker to inject arbitrary JavaScript code that executes in the context of the user s browser, potentially leading to session hijacking or phishing attacks." + }, + { + "lang": "es", + "value": "CloudClassroom-PHP-Project 1.0 contiene una vulnerabilidad Cross-site Scripting (XSS) Reflejado en el par\u00e1metro de correo electr\u00f3nico del endpoint postquerypublic. Una depuraci\u00f3n incorrecta permite a un atacante inyectar c\u00f3digo JavaScript arbitrario que se ejecuta en el contexto del navegador del usuario, lo que podr\u00eda provocar secuestro de sesi\u00f3n o ataques de phishing." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-508xx/CVE-2025-50867.json b/CVE-2025/CVE-2025-508xx/CVE-2025-50867.json index 6ac79abe777..175e515fb19 100644 --- a/CVE-2025/CVE-2025-508xx/CVE-2025-50867.json +++ b/CVE-2025/CVE-2025-508xx/CVE-2025-50867.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-31T16:15:31.293", "lastModified": "2025-07-31T20:15:45.340", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where the Q5 POST parameter is directly embedded in SQL statements without sanitization." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de inyecci\u00f3n SQL en el endpoint takeassessment2.php de CloudClassroom-PHP-Project 1.0, donde el par\u00e1metro POST Q5 est\u00e1 directamente incrustado en declaraciones SQL sin depuraci\u00f3n." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-50xx/CVE-2025-5038.json b/CVE-2025/CVE-2025-50xx/CVE-2025-5038.json index b0a7bf33b8a..77672e4f223 100644 --- a/CVE-2025/CVE-2025-50xx/CVE-2025-5038.json +++ b/CVE-2025/CVE-2025-50xx/CVE-2025-5038.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@autodesk.com", "published": "2025-07-29T18:15:31.590", "lastModified": "2025-07-31T18:42:56.503", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-50xx/CVE-2025-5043.json b/CVE-2025/CVE-2025-50xx/CVE-2025-5043.json index 088852e703d..1f2f7518b9a 100644 --- a/CVE-2025/CVE-2025-50xx/CVE-2025-5043.json +++ b/CVE-2025/CVE-2025-50xx/CVE-2025-5043.json @@ -3,7 +3,7 @@ "sourceIdentifier": "psirt@autodesk.com", "published": "2025-07-29T18:15:31.783", "lastModified": "2025-07-31T18:42:56.503", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-50xx/CVE-2025-5084.json b/CVE-2025/CVE-2025-50xx/CVE-2025-5084.json index 13fcb7575d2..f9a5260914c 100644 --- a/CVE-2025/CVE-2025-50xx/CVE-2025-5084.json +++ b/CVE-2025/CVE-2025-50xx/CVE-2025-5084.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018argsArray['read_more_text']\u2019 parameter in all versions up to, and including, 3.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link." + }, + { + "lang": "es", + "value": "El complemento Post Grid Master para WordPress es vulnerable a ataques de Cross-Site Scripting reflejado a trav\u00e9s del par\u00e1metro 'argsArray['read_more_text']' en todas las versiones hasta la 3.4.13 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutan si logran enga\u00f1ar al usuario para que realice una acci\u00f3n, como hacer clic en un enlace." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-510xx/CVE-2025-51044.json b/CVE-2025/CVE-2025-510xx/CVE-2025-51044.json index f0098500328..8f320723474 100644 --- a/CVE-2025/CVE-2025-510xx/CVE-2025-51044.json +++ b/CVE-2025/CVE-2025-510xx/CVE-2025-51044.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-29T19:15:46.590", "lastModified": "2025-07-31T18:42:56.503", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-510xx/CVE-2025-51045.json b/CVE-2025/CVE-2025-510xx/CVE-2025-51045.json index 3df15b1ddac..624012a3299 100644 --- a/CVE-2025/CVE-2025-510xx/CVE-2025-51045.json +++ b/CVE-2025/CVE-2025-510xx/CVE-2025-51045.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-29T19:15:46.710", "lastModified": "2025-07-31T18:42:56.503", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-513xx/CVE-2025-51396.json b/CVE-2025/CVE-2025-513xx/CVE-2025-51396.json index e9e693ee821..035aca086cd 100644 --- a/CVE-2025/CVE-2025-513xx/CVE-2025-51396.json +++ b/CVE-2025/CVE-2025-513xx/CVE-2025-51396.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T19:15:30.957", "lastModified": "2025-07-22T14:15:35.157", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-513xx/CVE-2025-51397.json b/CVE-2025/CVE-2025-513xx/CVE-2025-51397.json index 13fd4704568..baca938f186 100644 --- a/CVE-2025/CVE-2025-513xx/CVE-2025-51397.json +++ b/CVE-2025/CVE-2025-513xx/CVE-2025-51397.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T19:15:31.073", "lastModified": "2025-07-22T14:15:35.317", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-513xx/CVE-2025-51398.json b/CVE-2025/CVE-2025-513xx/CVE-2025-51398.json index 1a7aba840bd..f07d5137d00 100644 --- a/CVE-2025/CVE-2025-513xx/CVE-2025-51398.json +++ b/CVE-2025/CVE-2025-513xx/CVE-2025-51398.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T19:15:31.187", "lastModified": "2025-07-22T14:15:35.483", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-514xx/CVE-2025-51400.json b/CVE-2025/CVE-2025-514xx/CVE-2025-51400.json index 7c22414501b..ca4aea26928 100644 --- a/CVE-2025/CVE-2025-514xx/CVE-2025-51400.json +++ b/CVE-2025/CVE-2025-514xx/CVE-2025-51400.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T19:15:31.310", "lastModified": "2025-07-22T14:15:35.647", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-514xx/CVE-2025-51401.json b/CVE-2025/CVE-2025-514xx/CVE-2025-51401.json index 5588d90101f..551d5b8f07b 100644 --- a/CVE-2025/CVE-2025-514xx/CVE-2025-51401.json +++ b/CVE-2025/CVE-2025-514xx/CVE-2025-51401.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T19:15:31.410", "lastModified": "2025-07-22T14:15:35.843", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-514xx/CVE-2025-51403.json b/CVE-2025/CVE-2025-514xx/CVE-2025-51403.json index 4fb3c8e41b6..cf4c6ac49d0 100644 --- a/CVE-2025/CVE-2025-514xx/CVE-2025-51403.json +++ b/CVE-2025/CVE-2025-514xx/CVE-2025-51403.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T19:15:31.510", "lastModified": "2025-07-22T13:05:40.573", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-514xx/CVE-2025-51411.json b/CVE-2025/CVE-2025-514xx/CVE-2025-51411.json index 8dc9f9f4279..bff4098f14a 100644 --- a/CVE-2025/CVE-2025-514xx/CVE-2025-51411.json +++ b/CVE-2025/CVE-2025-514xx/CVE-2025-51411.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A reflected cross-site scripting (XSS) vulnerability exists in Institute-of-Current-Students v1.0 via the email parameter in the /postquerypublic endpoint. The application fails to properly sanitize user input before reflecting it in the HTML response. This allows unauthenticated attackers to inject and execute arbitrary JavaScript code in the context of the victim's browser by tricking them into visiting a crafted URL or submitting a malicious form. Successful exploitation may lead to session hijacking, credential theft, or other client-side attacks." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en Institute-of-Current-Students v1.0 a trav\u00e9s del par\u00e1metro de correo electr\u00f3nico en el endpoint /postquerypublic. La aplicaci\u00f3n no depura correctamente la entrada del usuario antes de reflejarla en la respuesta HTML. Esto permite a atacantes no autenticados inyectar y ejecutar c\u00f3digo JavaScript arbitrario en el navegador de la v\u00edctima, enga\u00f1\u00e1ndola para que visite una URL manipulada o env\u00ede un formulario malicioso. Una explotaci\u00f3n exitosa puede provocar secuestro de sesi\u00f3n, robo de credenciales u otros ataques del lado del cliente." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-515xx/CVE-2025-51503.json b/CVE-2025/CVE-2025-515xx/CVE-2025-51503.json index 9f92ca0173f..4fc7c0fd42a 100644 --- a/CVE-2025/CVE-2025-515xx/CVE-2025-51503.json +++ b/CVE-2025/CVE-2025-515xx/CVE-2025-51503.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-31T18:15:42.147", "lastModified": "2025-07-31T19:15:29.703", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers." + }, + { + "lang": "es", + "value": "Una vulnerabilidad de Cross-site Scripting (XSS) almacenado en Microweber CMS 2.0 permite a los atacantes inyectar scripts maliciosos en los campos del perfil del usuario, lo que provoca la ejecuci\u00f3n arbitraria de JavaScript en los navegadores del administrador." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-515xx/CVE-2025-51569.json b/CVE-2025/CVE-2025-515xx/CVE-2025-51569.json index 1942edf8dde..d6ef4d0b789 100644 --- a/CVE-2025/CVE-2025-515xx/CVE-2025-51569.json +++ b/CVE-2025/CVE-2025-515xx/CVE-2025-51569.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A cross-site scripting (XSS) vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U14_06 router's web interface. The /goform/goform_get_cmd_process endpoint fails to sanitize user input in the cmd parameter before reflecting it into a text/html response. This allows unauthenticated attackers to inject arbitrary JavaScript, which is executed in the context of the router's origin when the crafted URL is accessed. The issue requires user interaction to exploit." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de Cross-site Scripting (XSS) en la interfaz web del router LB-Link BL-CPE300M 01.01.02P42U14_06. El endpoint /goform/goform_get_cmd_process no depura la entrada del usuario en el par\u00e1metro cmd antes de reflejarla en una respuesta text/html. Esto permite a atacantes no autenticados inyectar JavaScript arbitrario, que se ejecuta en el contexto del origen del router al acceder a la URL manipulada. El problema requiere la interacci\u00f3n del usuario para explotarse." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-51xx/CVE-2025-5120.json b/CVE-2025/CVE-2025-51xx/CVE-2025-5120.json index 4fb8014d7b6..7393c4ed018 100644 --- a/CVE-2025/CVE-2025-51xx/CVE-2025-5120.json +++ b/CVE-2025/CVE-2025-51xx/CVE-2025-5120.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security@huntr.dev", "published": "2025-07-27T08:15:25.403", "lastModified": "2025-07-29T14:14:29.590", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-522xx/CVE-2025-52203.json b/CVE-2025/CVE-2025-522xx/CVE-2025-52203.json index d3336e0d03a..6d96873a939 100644 --- a/CVE-2025/CVE-2025-522xx/CVE-2025-52203.json +++ b/CVE-2025/CVE-2025-522xx/CVE-2025-52203.json @@ -3,12 +3,16 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-31T16:15:31.423", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are subsequently stored in the database. When a legitimate user logs in and is redirected to the Dashboard panel \"automatically upon authentication the malicious script executes in the user's browser context." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de cross-site scripting (XSS) almacenado en DevaslanPHP project-management v1.2.4. La vulnerabilidad reside en el campo \"Nombre del ticket\", que no depura correctamente la informaci\u00f3n proporcionada por el usuario. Un atacante autenticado puede inyectar payloads de JavaScript maliciosas en este campo, que posteriormente se almacenan en la base de datos. Cuando un usuario leg\u00edtimo inicia sesi\u00f3n y es redirigido al panel del usuario, tras la autenticaci\u00f3n, el script malicioso se ejecuta autom\u00e1ticamente en el contexto del navegador del usuario." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-522xx/CVE-2025-52284.json b/CVE-2025/CVE-2025-522xx/CVE-2025-52284.json index 533a9c1d454..836da71c862 100644 --- a/CVE-2025/CVE-2025-522xx/CVE-2025-52284.json +++ b/CVE-2025/CVE-2025-522xx/CVE-2025-52284.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-29T18:15:30.433", "lastModified": "2025-07-31T18:42:56.503", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-522xx/CVE-2025-52289.json b/CVE-2025/CVE-2025-522xx/CVE-2025-52289.json index 759894b5c0b..92a377ea129 100644 --- a/CVE-2025/CVE-2025-522xx/CVE-2025-52289.json +++ b/CVE-2025/CVE-2025-522xx/CVE-2025-52289.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom \"pending\" to \"active\" without requiring administrator approval." + }, + { + "lang": "es", + "value": "Una vulnerabilidad de control de acceso roto en MagnusBilling v7.8.5.3 permite a los usuarios reci\u00e9n registrados obtener privilegios aumentados enviando una solicitud manipulada a /mbilling/index.php/user/save para establecer el estado de su cuenta de \"pendiente\" a \"activo\" sin requerir la aprobaci\u00f3n del administrador." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-523xx/CVE-2025-52360.json b/CVE-2025/CVE-2025-523xx/CVE-2025-52360.json index dbf3188ab8f..e7157fd4586 100644 --- a/CVE-2025/CVE-2025-523xx/CVE-2025-52360.json +++ b/CVE-2025/CVE-2025-523xx/CVE-2025-52360.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05. Unsanitized input entered in the search field is reflected in the search history interface, leading to the execution of arbitrary JavaScript in the browser context when the user interacts with the interface." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de Cross-Site Scripting (XSS) en la funci\u00f3n de b\u00fasqueda OPAC de Koha Library Management System v24.05. La informaci\u00f3n no depurada introducida en el campo de b\u00fasqueda se refleja en la interfaz del historial de b\u00fasqueda, lo que provoca la ejecuci\u00f3n de JavaScript arbitrario en el contexto del navegador cuando el usuario interact\u00faa con la interfaz." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-523xx/CVE-2025-52364.json b/CVE-2025/CVE-2025-523xx/CVE-2025-52364.json index e5cb36ecc2c..b289bd85c63 100644 --- a/CVE-2025/CVE-2025-523xx/CVE-2025-52364.json +++ b/CVE-2025/CVE-2025-523xx/CVE-2025-52364.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-09T15:15:24.650", "lastModified": "2025-07-14T17:15:35.283", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-523xx/CVE-2025-52372.json b/CVE-2025/CVE-2025-523xx/CVE-2025-52372.json index 5dffbc578a0..54e365e1c87 100644 --- a/CVE-2025/CVE-2025-523xx/CVE-2025-52372.json +++ b/CVE-2025/CVE-2025-523xx/CVE-2025-52372.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T16:15:29.770", "lastModified": "2025-07-22T16:15:32.293", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-523xx/CVE-2025-52373.json b/CVE-2025/CVE-2025-523xx/CVE-2025-52373.json index 0d48fff5ef8..f8b6b6419be 100644 --- a/CVE-2025/CVE-2025-523xx/CVE-2025-52373.json +++ b/CVE-2025/CVE-2025-523xx/CVE-2025-52373.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T16:15:29.893", "lastModified": "2025-07-22T16:15:32.513", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-523xx/CVE-2025-52374.json b/CVE-2025/CVE-2025-523xx/CVE-2025-52374.json index ffe228f2123..2955837e7b3 100644 --- a/CVE-2025/CVE-2025-523xx/CVE-2025-52374.json +++ b/CVE-2025/CVE-2025-523xx/CVE-2025-52374.json @@ -3,7 +3,7 @@ "sourceIdentifier": "cve@mitre.org", "published": "2025-07-21T16:15:30.010", "lastModified": "2025-07-22T16:15:32.727", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-528xx/CVE-2025-52887.json b/CVE-2025/CVE-2025-528xx/CVE-2025-52887.json index 830bdfac7bc..eab0a8c7f56 100644 --- a/CVE-2025/CVE-2025-528xx/CVE-2025-52887.json +++ b/CVE-2025/CVE-2025-528xx/CVE-2025-52887.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-06-26T15:15:23.350", "lastModified": "2025-06-26T18:57:43.670", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-52xx/CVE-2025-5243.json b/CVE-2025/CVE-2025-52xx/CVE-2025-5243.json index 4b922c75d79..ff3b9a38610 100644 --- a/CVE-2025/CVE-2025-52xx/CVE-2025-5243.json +++ b/CVE-2025/CVE-2025-52xx/CVE-2025-5243.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion.This issue affects Information Portal: before 13.06.2025." + }, + { + "lang": "es", + "value": "La vulnerabilidad en SMG Software Information Portal que permite la inyecci\u00f3n de c\u00f3digo, la carga de un shell web a un servidor web y la inclusi\u00f3n de c\u00f3digo, provoca la carga sin restricciones de archivos de tipo peligroso y la neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando del sistema operativo ('Inyecci\u00f3n de comando del sistema operativo'). Este problema afecta a Information Portal: antes del 13/06/2025." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-52xx/CVE-2025-5253.json b/CVE-2025/CVE-2025-52xx/CVE-2025-5253.json index db790469566..ca3ecba71b6 100644 --- a/CVE-2025/CVE-2025-52xx/CVE-2025-5253.json +++ b/CVE-2025/CVE-2025-52xx/CVE-2025-5253.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Allocation of Resources Without Limits or Throttling vulnerability in Kron Technologies Kron PAM allows HTTP DoS.This issue affects Kron PAM: before 3.7." + }, + { + "lang": "es", + "value": "Vulnerabilidad de asignaci\u00f3n de recursos sin l\u00edmites o limitaci\u00f3n en Kron Technologies Kron PAM permite HTTP DoS. Este problema afecta a Kron PAM: antes de 3.7." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-52xx/CVE-2025-5254.json b/CVE-2025/CVE-2025-52xx/CVE-2025-5254.json index c5f6536d808..2fcc581aae9 100644 --- a/CVE-2025/CVE-2025-52xx/CVE-2025-5254.json +++ b/CVE-2025/CVE-2025-52xx/CVE-2025-5254.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kron Technologies Kron PAM allows Stored XSS.This issue affects Kron PAM: before 3.7." + }, + { + "lang": "es", + "value": "Vulnerabilidad de neutralizaci\u00f3n incorrecta de entrada durante la generaci\u00f3n de p\u00e1ginas web (XSS o 'Cross-site Scripting') en Kron Technologies Kron PAM permite XSS almacenado. Este problema afecta a Kron PAM: antes de 3.7." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-530xx/CVE-2025-53081.json b/CVE-2025/CVE-2025-530xx/CVE-2025-53081.json index 15a1a617042..784b582fa23 100644 --- a/CVE-2025/CVE-2025-530xx/CVE-2025-53081.json +++ b/CVE-2025/CVE-2025-530xx/CVE-2025-53081.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An 'Arbitrary File Creation' in Samsung DMS(Data Management Server) allows attackers to create arbitrary files in unintended locations on the filesystem. Exploitation is restricted to specific, authorized private IP addresses." + }, + { + "lang": "es", + "value": "Una \"Creaci\u00f3n de Archivos Arbitrarios\" en Samsung DMS(Data Management Server) permite a los atacantes crear archivos arbitrarios en ubicaciones no deseadas del sistema de archivos. La explotaci\u00f3n est\u00e1 restringida a direcciones IP privadas espec\u00edficas y autorizadas." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-530xx/CVE-2025-53082.json b/CVE-2025/CVE-2025-530xx/CVE-2025-53082.json index 395ad424122..e41c4c0d475 100644 --- a/CVE-2025/CVE-2025-530xx/CVE-2025-53082.json +++ b/CVE-2025/CVE-2025-530xx/CVE-2025-53082.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "An 'Arbitrary File Deletion' in Samsung DMS(Data Management Server) allows attackers to delete arbitrary files from unintended locations on the filesystem. Exploitation is restricted to specific, authorized private IP addresses." + }, + { + "lang": "es", + "value": "Una \"Eliminaci\u00f3n arbitraria de archivos\" en Samsung DMS(Data Management Server) permite a los atacantes eliminar archivos arbitrarios de ubicaciones no deseadas en el sistema de archivos. La explotaci\u00f3n est\u00e1 restringida a direcciones IP privadas espec\u00edficas y autorizadas." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-533xx/CVE-2025-53399.json b/CVE-2025/CVE-2025-533xx/CVE-2025-53399.json index 2e0c11b96e7..f108cd00755 100644 --- a/CVE-2025/CVE-2025-533xx/CVE-2025-53399.json +++ b/CVE-2025/CVE-2025-533xx/CVE-2025-53399.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP media streams via RTP packets (except when the relay is configured for strict source and learning disabled). Version 13.4.1.1 fixes the heuristic mode by limiting exposure to the first five packets, and introduces a recrypt flag that fully prevents SRTP attacks when both mitigations are enabled." + }, + { + "lang": "es", + "value": "En Sipwise rtpengine anterior a la versi\u00f3n 13.4.1.1, un error de validaci\u00f3n de origen en la l\u00f3gica de aprendizaje de endpoints del n\u00facleo de retransmisi\u00f3n de medios permite a atacantes remotos inyectar o interceptar flujos de medios RTP/SRTP mediante paquetes RTP (excepto cuando la retransmisi\u00f3n est\u00e1 configurada con origen estricto y el aprendizaje est\u00e1 deshabilitado). La versi\u00f3n 13.4.1.1 corrige el modo heur\u00edstico limitando la exposici\u00f3n a los primeros cinco paquetes e introduce un indicador de recifrado que previene completamente los ataques SRTP cuando ambas mitigaciones est\u00e1n habilitadas." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-535xx/CVE-2025-53537.json b/CVE-2025/CVE-2025-535xx/CVE-2025-53537.json index a59967cd176..e85512e64bf 100644 --- a/CVE-2025/CVE-2025-535xx/CVE-2025-53537.json +++ b/CVE-2025/CVE-2025-535xx/CVE-2025-53537.json @@ -3,12 +3,16 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-07-23T21:15:26.613", "lastModified": "2025-07-25T15:29:44.523", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, there is a traffic-induced memory leak that can starve the process of memory, leading to loss of visibility. To workaround this issue, set `suricata.yaml app-layer.protocols.http.libhtp.default-config.lzma-enabled` to false. This issue is fixed in version 0.5.51." + }, + { + "lang": "es", + "value": "LibHTP es un analizador con seguridad para el protocolo HTTP y sus componentes relacionados. En las versiones 0.5.50 y anteriores, existe una fuga de memoria inducida por el tr\u00e1fico que puede agotar la memoria del proceso, lo que provoca p\u00e9rdida de visibilidad. Para solucionar este problema, configure `suricata.yaml app-layer.protocols.http.libhtp.default-config.lzma-enabled` como falso. Este problema se solucion\u00f3 en la versi\u00f3n 0.5.51." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-536xx/CVE-2025-53628.json b/CVE-2025/CVE-2025-536xx/CVE-2025-53628.json index fa6499636a7..4f83415bfe8 100644 --- a/CVE-2025/CVE-2025-536xx/CVE-2025-53628.json +++ b/CVE-2025/CVE-2025-536xx/CVE-2025-53628.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-07-10T20:15:27.220", "lastModified": "2025-07-15T13:14:49.980", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-536xx/CVE-2025-53629.json b/CVE-2025/CVE-2025-536xx/CVE-2025-53629.json index cec5ca25a7a..198383bf48f 100644 --- a/CVE-2025/CVE-2025-536xx/CVE-2025-53629.json +++ b/CVE-2025/CVE-2025-536xx/CVE-2025-53629.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-07-10T20:15:27.370", "lastModified": "2025-07-15T13:14:49.980", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-539xx/CVE-2025-53940.json b/CVE-2025/CVE-2025-539xx/CVE-2025-53940.json index 6a572efa9d9..20c1e46b94a 100644 --- a/CVE-2025/CVE-2025-539xx/CVE-2025-53940.json +++ b/CVE-2025/CVE-2025-539xx/CVE-2025-53940.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for token verification. This allowed for a potential timing attack where an attacker would try different token values and observe tiny differences in the response time (wrong characters fail faster) to guess the whole token one character at a time. This is fixed in version 6.0.1." + }, + { + "lang": "es", + "value": "Quiet es una alternativa a las aplicaciones de chat en equipo como Slack, Discord y Element, que no requiere confiar en un servidor central ni ejecutar uno propio. En las versiones 6.1.0-alpha.4 y anteriores, la API de Quiet para la comunicaci\u00f3n entre el backend y el frontend utilizaba una funci\u00f3n de comparaci\u00f3n insegura y no constante para la verificaci\u00f3n de tokens. Esto permit\u00eda un posible ataque de sincronizaci\u00f3n: un atacante probaba diferentes valores de token y observaba peque\u00f1as diferencias en el tiempo de respuesta (los caracteres incorrectos fallan m\u00e1s r\u00e1pido) para adivinar el token completo, car\u00e1cter por car\u00e1cter. Esto se solucion\u00f3 en la versi\u00f3n 6.0.1." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-539xx/CVE-2025-53942.json b/CVE-2025/CVE-2025-539xx/CVE-2025-53942.json index 7f722a61ecd..9b6821743c3 100644 --- a/CVE-2025/CVE-2025-539xx/CVE-2025-53942.json +++ b/CVE-2025/CVE-2025-539xx/CVE-2025-53942.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked their accounts to OAuth/SAML providers can still retain partial access to the system despite their accounts being deactivated. They end up in a half-authenticated state where they cannot access the API but crucially they can authorize applications if they know the URL of the application. To workaround this issue, developers can add an expression policy to the user login stage on the respective authentication flow with the expression of return request.context[\"pending_user\"].is_active. This modification ensures that the return statement only activates the user login stage when the user is active. This issue is fixed in versions authentik 2025.4.4 and 2025.6.4." + }, + { + "lang": "es", + "value": "authentik es un proveedor de identidad de c\u00f3digo abierto que prioriza la flexibilidad y la versatilidad, compatible con una amplia gama de protocolos. En las versiones 2025.4.4 y anteriores, as\u00ed como en las versiones 2025.6.0-rc1 a 2025.6.3, los usuarios desactivados que se registraron mediante OAuth/SAML o vincularon sus cuentas a proveedores de OAuth/SAML a\u00fan pueden conservar acceso parcial al sistema a pesar de que sus cuentas est\u00e9n desactivadas. Al final, se encuentran en un estado de autenticaci\u00f3n parcial, donde no pueden acceder a la API, pero, fundamentalmente, pueden autorizar aplicaciones si conocen la URL de la aplicaci\u00f3n. Para solucionar este problema, los desarrolladores pueden agregar una pol\u00edtica de expresi\u00f3n a la etapa de inicio de sesi\u00f3n del usuario en el flujo de autenticaci\u00f3n correspondiente con la expresi\u00f3n `return request.context[\"pending_user\"].is_active`. Esta modificaci\u00f3n garantiza que la declaraci\u00f3n `return` solo active la etapa de inicio de sesi\u00f3n del usuario cuando este est\u00e9 activo. Este problema se solucion\u00f3 en las versiones authentik 2025.4.4 y 2025.6.4." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-540xx/CVE-2025-54085.json b/CVE-2025/CVE-2025-540xx/CVE-2025-54085.json index d4643377c45..a89950654a2 100644 --- a/CVE-2025/CVE-2025-540xx/CVE-2025-54085.json +++ b/CVE-2025/CVE-2025-540xx/CVE-2025-54085.json @@ -3,7 +3,7 @@ "sourceIdentifier": "SecurityResponse@netmotionsoftware.com", "published": "2025-07-31T00:15:27.290", "lastModified": "2025-07-31T18:42:37.870", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-540xx/CVE-2025-54090.json b/CVE-2025/CVE-2025-540xx/CVE-2025-54090.json index b52b6ba2270..f5670e79556 100644 --- a/CVE-2025/CVE-2025-540xx/CVE-2025-54090.json +++ b/CVE-2025/CVE-2025-540xx/CVE-2025-54090.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A bug in Apache HTTP Server 2.4.64 results in all \"RewriteCond expr ...\" tests evaluating as \"true\".\n\n\n\nUsers are recommended to upgrade to version 2.4.65, which fixes the issue." + }, + { + "lang": "es", + "value": "Un error en Apache HTTP Server 2.4.64 provoca que todas las pruebas \"RewriteCond expr ...\" se eval\u00faen como \"verdaderas\". Se recomienda a los usuarios actualizar a la versi\u00f3n 2.4.65, que soluciona el problema." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-541xx/CVE-2025-54138.json b/CVE-2025/CVE-2025-541xx/CVE-2025-54138.json index 2603fb804c1..338f060c803 100644 --- a/CVE-2025/CVE-2025-541xx/CVE-2025-54138.json +++ b/CVE-2025/CVE-2025-541xx/CVE-2025-54138.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-07-22T22:15:38.240", "lastModified": "2025-07-25T15:29:44.523", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-541xx/CVE-2025-54141.json b/CVE-2025/CVE-2025-541xx/CVE-2025-54141.json index d5dd1d6b1e5..5bfc3e217cf 100644 --- a/CVE-2025/CVE-2025-541xx/CVE-2025-54141.json +++ b/CVE-2025/CVE-2025-541xx/CVE-2025-54141.json @@ -3,7 +3,7 @@ "sourceIdentifier": "security-advisories@github.com", "published": "2025-07-22T22:15:38.537", "lastModified": "2025-07-25T15:29:44.523", - "vulnStatus": "Awaiting Analysis", + "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [ { diff --git a/CVE-2025/CVE-2025-542xx/CVE-2025-54294.json b/CVE-2025/CVE-2025-542xx/CVE-2025-54294.json index 58d7d2bbfa9..9280e265bd4 100644 --- a/CVE-2025/CVE-2025-542xx/CVE-2025-54294.json +++ b/CVE-2025/CVE-2025-542xx/CVE-2025-54294.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A SQLi vulnerability in Komento component 4.0.0-4.0.7for Joomla was discovered. The issue allows unprivileged users to execute arbitrary SQL commands." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 una vulnerabilidad SQLi en el componente Komento 4.0.0-4.0.7 para Joomla. El problema permite a usuarios sin privilegios ejecutar comandos SQL arbitrarios." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-542xx/CVE-2025-54295.json b/CVE-2025/CVE-2025-542xx/CVE-2025-54295.json index 10f55266433..dcb661c727b 100644 --- a/CVE-2025/CVE-2025-542xx/CVE-2025-54295.json +++ b/CVE-2025/CVE-2025-542xx/CVE-2025-54295.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla was discovered." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 una vulnerabilidad XSS reflejado en el componente DJ-Reviews 1.0-1.3.6 para Joomla." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-542xx/CVE-2025-54296.json b/CVE-2025/CVE-2025-542xx/CVE-2025-54296.json index 158ee212f3d..1bc42ad96f8 100644 --- a/CVE-2025/CVE-2025-542xx/CVE-2025-54296.json +++ b/CVE-2025/CVE-2025-542xx/CVE-2025-54296.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla was discovered." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 una vulnerabilidad XSS almacenado en el componente ProFiles 1.0-1.5.0 para Joomla." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-542xx/CVE-2025-54297.json b/CVE-2025/CVE-2025-542xx/CVE-2025-54297.json index f71e9725845..0fb6957669a 100644 --- a/CVE-2025/CVE-2025-542xx/CVE-2025-54297.json +++ b/CVE-2025/CVE-2025-542xx/CVE-2025-54297.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "A stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla was discovered." + }, + { + "lang": "es", + "value": "Se descubri\u00f3 una vulnerabilidad XSS almacenado en el componente CComment 5.0.0-6.1.14 para Joomla." } ], "metrics": { diff --git a/CVE-2025/CVE-2025-543xx/CVE-2025-54365.json b/CVE-2025/CVE-2025-543xx/CVE-2025-54365.json index cdca3f91fbd..4ab9df2a573 100644 --- a/CVE-2025/CVE-2025-543xx/CVE-2025-54365.json +++ b/CVE-2025/CVE-2025-543xx/CVE-2025-54365.json @@ -9,6 +9,10 @@ { "lang": "en", "value": "fastapi-guard is a security library for FastAPI that provides middleware to control IPs, log requests, detect penetration attempts and more. In version 3.0.1, the regular expression patched to mitigate the ReDoS vulnerability by limiting the length of string fails to catch inputs that exceed this limit. This type of patch fails to detect cases in which the string representing the attributes of a