From 4ff994bd43ecc29811f4e5afd0682c9db1119c33 Mon Sep 17 00:00:00 2001 From: cad-safe-bot Date: Sat, 8 Mar 2025 23:03:48 +0000 Subject: [PATCH] Auto-Update: 2025-03-08T23:00:19.561693+00:00 --- CVE-2025/CVE-2025-21xx/CVE-2025-2112.json | 141 ++++++++++++++++++++ CVE-2025/CVE-2025-278xx/CVE-2025-27840.json | 12 +- README.md | 11 +- _state.csv | 3 +- 4 files changed, 155 insertions(+), 12 deletions(-) create mode 100644 CVE-2025/CVE-2025-21xx/CVE-2025-2112.json diff --git a/CVE-2025/CVE-2025-21xx/CVE-2025-2112.json b/CVE-2025/CVE-2025-21xx/CVE-2025-2112.json new file mode 100644 index 00000000000..5eed83544b6 --- /dev/null +++ b/CVE-2025/CVE-2025-21xx/CVE-2025-2112.json @@ -0,0 +1,141 @@ +{ + "id": "CVE-2025-2112", + "sourceIdentifier": "cna@vuldb.com", + "published": "2025-03-08T22:15:36.443", + "lastModified": "2025-03-08T22:15:36.443", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability was found in user-xiangpeng yaoqishan up to a47fec4a31cbd13698c592dfdc938c8824dd25e4. It has been declared as critical. Affected by this vulnerability is the function getMediaLisByFilter of the file cn/javaex/yaoqishan/service/media_info/MediaInfoService.java. The manipulation of the argument typeId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way." + } + ], + "metrics": { + "cvssMetricV40": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", + "baseScore": 5.3, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "LOW", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "confidentialityRequirement": "NOT_DEFINED", + "integrityRequirement": "NOT_DEFINED", + "availabilityRequirement": "NOT_DEFINED", + "modifiedAttackVector": "NOT_DEFINED", + "modifiedAttackComplexity": "NOT_DEFINED", + "modifiedAttackRequirements": "NOT_DEFINED", + "modifiedPrivilegesRequired": "NOT_DEFINED", + "modifiedUserInteraction": "NOT_DEFINED", + "modifiedVulnConfidentialityImpact": "NOT_DEFINED", + "modifiedVulnIntegrityImpact": "NOT_DEFINED", + "modifiedVulnAvailabilityImpact": "NOT_DEFINED", + "modifiedSubConfidentialityImpact": "NOT_DEFINED", + "modifiedSubIntegrityImpact": "NOT_DEFINED", + "modifiedSubAvailabilityImpact": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED" + } + } + ], + "cvssMetricV31": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseScore": 6.3, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "LOW" + }, + "exploitabilityScore": 2.8, + "impactScore": 3.4 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", + "baseScore": 6.5, + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "SINGLE", + "confidentialityImpact": "PARTIAL", + "integrityImpact": "PARTIAL", + "availabilityImpact": "PARTIAL" + }, + "baseSeverity": "MEDIUM", + "exploitabilityScore": 8.0, + "impactScore": 6.4, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-74" + }, + { + "lang": "en", + "value": "CWE-89" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/xiaolian-11/code_demo/blob/main/yaoqishan-sql.md", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?ctiid.299005", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.299005", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?submit.506085", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2025/CVE-2025-278xx/CVE-2025-27840.json b/CVE-2025/CVE-2025-278xx/CVE-2025-27840.json index f672e688e2b..843c9fbe00e 100644 --- a/CVE-2025/CVE-2025-278xx/CVE-2025-27840.json +++ b/CVE-2025/CVE-2025-278xx/CVE-2025-27840.json @@ -2,7 +2,7 @@ "id": "CVE-2025-27840", "sourceIdentifier": "cve@mitre.org", "published": "2025-03-08T20:15:36.027", - "lastModified": "2025-03-08T20:15:36.027", + "lastModified": "2025-03-08T21:15:11.177", "vulnStatus": "Received", "cveTags": [], "descriptions": [ @@ -18,19 +18,19 @@ "type": "Secondary", "cvssData": { "version": "3.1", - "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L", - "baseScore": 7.1, - "baseSeverity": "HIGH", + "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L", + "baseScore": 6.8, + "baseSeverity": "MEDIUM", "attackVector": "PHYSICAL", "attackComplexity": "HIGH", - "privilegesRequired": "NONE", + "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW" }, - "exploitabilityScore": 0.5, + "exploitabilityScore": 0.3, "impactScore": 6.0 } ] diff --git a/README.md b/README.md index acc748799a9..dbd68e310af 100644 --- a/README.md +++ b/README.md @@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2025-03-08T21:00:19.630985+00:00 +2025-03-08T23:00:19.561693+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2025-03-08T20:15:36.027000+00:00 +2025-03-08T22:15:36.443000+00:00 ``` ### Last Data Feed Release @@ -33,20 +33,21 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### Total Number of included CVEs ```plain -284553 +284554 ``` ### CVEs added in the last Commit Recently added CVEs: `1` -- [CVE-2025-27840](CVE-2025/CVE-2025-278xx/CVE-2025-27840.json) (`2025-03-08T20:15:36.027`) +- [CVE-2025-2112](CVE-2025/CVE-2025-21xx/CVE-2025-2112.json) (`2025-03-08T22:15:36.443`) ### CVEs modified in the last Commit -Recently modified CVEs: `0` +Recently modified CVEs: `1` +- [CVE-2025-27840](CVE-2025/CVE-2025-278xx/CVE-2025-27840.json) (`2025-03-08T21:15:11.177`) ## Download and Usage diff --git a/_state.csv b/_state.csv index f02eab91616..62e28189cd7 100644 --- a/_state.csv +++ b/_state.csv @@ -281491,6 +281491,7 @@ CVE-2025-21106,0,0,f21695bcd3dc50ebb62318d228568a1613cd20d1a89ae6dcd1f4af03df1c2 CVE-2025-21107,0,0,0827735892f4001f988a0739aad719c8ee1fb9144fe1da312da1da34f24b5ce6,2025-02-07T20:01:14.760000 CVE-2025-21111,0,0,36449c466fabe660f3fc2f10d8992e6a7d9c5e3d2cf72d3dce2cc840c6da552b,2025-01-24T19:11:42.417000 CVE-2025-21117,0,0,3c59ddab13aed7617d82cbb9fbab3c190cbfe8b424cc570d2e879fe06ca6cee2,2025-02-05T14:15:27.417000 +CVE-2025-2112,1,1,85227d11e81908281475abb4c87b58749be99c2e996f8b7b4c8c362d9654e82a,2025-03-08T22:15:36.443000 CVE-2025-21121,0,0,1697e078ff9a5405d9a543461696c63d50506a646e18e458652be622eb5556f4,2025-03-03T14:54:17.487000 CVE-2025-21122,0,0,969e44e0224fb47d95b87aed16b2a93d9ca09db3ac6fe7fd40cad9e935dc7db9,2025-02-11T14:47:41.453000 CVE-2025-21123,0,0,0be58033a62e1c138323b992604392193cd26a8c4f221072c6847ce8703ed4eb,2025-03-03T14:54:17.487000 @@ -284551,4 +284552,4 @@ CVE-2025-27824,0,0,bbbadd94bca912d17091ba5687790372eed06151266f5eb5403da18d55309 CVE-2025-27825,0,0,99e9b9d3befd54cbb55880416607fbc7e5d90c9fee9cdc2881cb2480979fee41,2025-03-07T22:15:38.380000 CVE-2025-27826,0,0,83fe28f5c1c38336a328c924367a016f575cf3bedee9c6070949943b515ded3d,2025-03-07T22:15:38.527000 CVE-2025-27839,0,0,212b3d30d2c1f53f372c7e143c6e03922deeb9da14f018db14d5749815db8000,2025-03-08T00:15:38.340000 -CVE-2025-27840,1,1,7d2524c6b84334effec85ee9043fdbd794fc7f9dac3f9570023d7c013da942a9,2025-03-08T20:15:36.027000 +CVE-2025-27840,0,1,5aa7d8e9662fef514fce3ae6e5e00a97364110257bf9630ffa81cb5e4cc13971,2025-03-08T21:15:11.177000