admin/nvd-json-data-feeds
1
0 Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2026-10-29 01:30:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2025-11-27T19:00:11.158146+00:00

Browse Source
This commit is contained in:
cad-safe-bot committed 2025-11-27 19:04:03 +00:00
1 parent 473e529b80
commit 913ae6e5de
7 files changed
+219 -17
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CVE-2025/CVE-2025-124xx/CVE-2025-12419.json
+2 -2
View File
@@ -2,13 +2,13 @@
"id": "CVE-2025-12419",
"sourceIdentifier": "[email protected]",
"published": "2025-11-27T16:15:46.957",
"lastModified": "2025-11-27T16:15:46.957",
"lastModified": "2025-11-27T18:15:45.890",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation or admin privileges to take over any user account via manipulation of authentication data during the OAuth completion flow"
"value": "Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost."
}
],
"metrics": {
CVE-2025/CVE-2025-124xx/CVE-2025-12421.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-12421",
"sourceIdentifier": "[email protected]",
"published": "2025-11-27T18:15:46.223",
"lastModified": "2025-11-27T18:15:46.223",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled)."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-303"
}
]
}
],
"references": [
{
"url": "https://mattermost.com/security-updates",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-125xx/CVE-2025-12559.json
+56
View File
@@ -0,0 +1,56 @@
{
"id": "CVE-2025-12559",
"sourceIdentifier": "[email protected]",
"published": "2025-11-27T17:15:46.530",
"lastModified": "2025-11-27T17:15:46.530",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/{channel_id}/common_teams endpoint"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"references": [
{
"url": "https://mattermost.com/security-updates",
"source": "[email protected]"
}
]
}
CVE-2025/CVE-2025-32xx/CVE-2025-3261.json
+82
View File
@@ -0,0 +1,82 @@
{
"id": "CVE-2025-3261",
"sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"published": "2025-11-27T18:15:46.403",
"lastModified": "2025-11-27T18:15:46.403",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the \"Image Gallery\", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://advisory.checkmarx.net/advisory/CVE-2025-3261/",
"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647"
},
{
"url": "https://github.com/thingsboard/thingsboard/commit/b2ae6f92d12206ea185a2e882945a6b69234bf03",
"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647"
}
]
}
CVE-2025/CVE-2025-53xx/CVE-2025-5318.json
+5 -1
View File
@@ -2,7 +2,7 @@
"id": "CVE-2025-5318",
"sourceIdentifier": "[email protected]",
"published": "2025-06-24T14:15:30.523",
"lastModified": "2025-11-20T22:16:00.117",
"lastModified": "2025-11-27T18:15:46.597",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
@@ -210,6 +210,10 @@
"url": "https://access.redhat.com/errata/RHSA-2025:21329",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:21829",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-5318",
"source": "[email protected]",
README.md
+10 -9
View File
@@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2025-11-27T17:00:11.878500+00:00
2025-11-27T19:00:11.158146+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2025-11-27T16:15:47.387000+00:00
2025-11-27T18:15:46.597000+00:00
```
### Last Data Feed Release
@@ -33,23 +33,24 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
319536
319539
```
### CVEs added in the last Commit
Recently added CVEs: `4`
Recently added CVEs: `3`
- [CVE-2025-12419](CVE-2025/CVE-2025-124xx/CVE-2025-12419.json) (`2025-11-27T16:15:46.957`)
- [CVE-2025-13757](CVE-2025/CVE-2025-137xx/CVE-2025-13757.json) (`2025-11-27T16:15:47.117`)
- [CVE-2025-13758](CVE-2025/CVE-2025-137xx/CVE-2025-13758.json) (`2025-11-27T16:15:47.257`)
- [CVE-2025-13765](CVE-2025/CVE-2025-137xx/CVE-2025-13765.json) (`2025-11-27T16:15:47.387`)
- [CVE-2025-12421](CVE-2025/CVE-2025-124xx/CVE-2025-12421.json) (`2025-11-27T18:15:46.223`)
- [CVE-2025-12559](CVE-2025/CVE-2025-125xx/CVE-2025-12559.json) (`2025-11-27T17:15:46.530`)
- [CVE-2025-3261](CVE-2025/CVE-2025-32xx/CVE-2025-3261.json) (`2025-11-27T18:15:46.403`)
### CVEs modified in the last Commit
Recently modified CVEs: `0`
Recently modified CVEs: `2`
- [CVE-2025-12419](CVE-2025/CVE-2025-124xx/CVE-2025-12419.json) (`2025-11-27T18:15:45.890`)
- [CVE-2025-5318](CVE-2025/CVE-2025-53xx/CVE-2025-5318.json) (`2025-11-27T18:15:46.597`)
## Download and Usage
_state.csv
+8 -5
View File
@@ -287755,7 +287755,8 @@ CVE-2025-12414,0,0,8dabb6354a884c1b0b603a9f195da7b4cd96d3b73b3b45f7ee435e57ee17b
CVE-2025-12415,0,0,81c866442fb9fd46706f21c98259794a7fcc8b091f645ddfb160f6da0ea0b137,2025-11-04T15:40:45.533000
CVE-2025-12416,0,0,ec35b538eb8dc521ad393c983756c4acf2a7d587acce4aede1c3f6348a585ec8,2025-11-04T15:40:45.533000
CVE-2025-12418,0,0,a1a3e7ea14eefbd5d5678a02f92ecd8b22ddabc6222cd4b305997e821ca32c95,2025-11-12T16:20:22.257000
CVE-2025-12419,1,1,a2ede39b47f1f34e8ae24a605c4fd0885b5662661338e02ddc65a641e8e0a752,2025-11-27T16:15:46.957000
CVE-2025-12419,0,1,a1377eb7c4d7a3d5ebf7597f4896c39774b811baa436e1c49b45df36d9b882ad,2025-11-27T18:15:45.890000
CVE-2025-12421,1,1,b0bd5b52eafce2498b846d1c6dca2b0c165211317c152ea8113ad23cb4ec32b2,2025-11-27T18:15:46.223000
CVE-2025-12422,0,0,c197f0fdb3e6b11f38ef90be4db88b71f39618450fda8bfc8f97063dbbe72561,2025-11-07T14:55:47.233000
CVE-2025-12423,0,0,04a15ea262d7c2854c3c856f4a7f1a5f874bc79c8e1c595fa69c870dc5f849ac,2025-11-07T14:52:25.637000
CVE-2025-12424,0,0,613cb5b6f521f743a1b8f2c197dbda50cc1c23974cf9bce65db85ece67adf490,2025-11-07T14:45:20.907000
@@ -287854,6 +287855,7 @@ CVE-2025-12552,0,0,1c24c8558597a77dbbbc084df221b889c7e896069707ae1145b2ad32ccb45
CVE-2025-12553,0,0,3815c784d9b16b9ad7150148367b04033a019132a966e0eb8e3ee76014b83c76,2025-11-10T14:48:31.427000
CVE-2025-12554,0,0,e089cc2157f5e7e12b257471030c28ead62687914c6e7296ccf11018afbbd1f0,2025-11-10T14:48:02.390000
CVE-2025-12556,0,0,c5b074647108f97a9c4d96cd633a49d026e902a1bedb75738b91b05b5390f15d,2025-11-06T19:45:09.883000
CVE-2025-12559,1,1,f3d435c5fa21fa2625ab64680fcb1afd1d1f4bcbb0b2f2c8c0625c53e4cafced,2025-11-27T17:15:46.530000
CVE-2025-1256,0,0,83056c3a87e9ccc659ae421f3d741ad8fa830a26a579fb9e0beb5aa4feaa59ef,2025-11-14T23:15:44.070000
CVE-2025-12560,0,0,e4b23946fe69b89f3bc62aaaf06572146512b5f96fc1ae25b2a2bca734f6be34,2025-11-06T19:45:09.883000
CVE-2025-12561,0,0,62a4a32158cfadd84f90fb904e5196a7c7a31f7e6642dc460d8432dc51d12b3d,2025-11-22T23:15:44.953000
@@ -288541,11 +288543,11 @@ CVE-2025-1373,0,0,77cfaa3a6771902b072de962115d7552a47b140ae8333a2256741e5279e5fe
CVE-2025-13735,0,0,6d7e37a24d3df88ec0d495428e2fb27d0bdf736c32751af3c3f72f561d67e861,2025-11-26T07:16:00.173000
CVE-2025-1374,0,0,c63cfcac4cc7e61dba55405a222ef271dee63812916e3abadacbbeed1056c0bb,2025-10-23T20:06:00.793000
CVE-2025-13742,0,0,f66b6c8bb17e0ae04f300afbab7e5871467b6ad126db1ef889f339bb7fa76786,2025-11-27T11:15:47.760000
CVE-2025-13757,1,1,7480802b2f9c1313963fb102739252399b720e5f38e43f218e71a2c8453facff,2025-11-27T16:15:47.117000
CVE-2025-13758,1,1,b748a8cc4d69893a496e35f0381ae6036efc5dd61a73fddac153cd83012816cc,2025-11-27T16:15:47.257000
CVE-2025-13757,0,0,7480802b2f9c1313963fb102739252399b720e5f38e43f218e71a2c8453facff,2025-11-27T16:15:47.117000
CVE-2025-13758,0,0,b748a8cc4d69893a496e35f0381ae6036efc5dd61a73fddac153cd83012816cc,2025-11-27T16:15:47.257000
CVE-2025-1376,0,0,de4237f06ae76bb371bb37755604dd21a28e325c264f69c8440e79b38d9646a3,2025-11-04T20:21:18.260000
CVE-2025-13762,0,0,2e71af04cb5680693defe086dc31cc2e5bffb1dabe6d051f6559290504bf5c6b,2025-11-27T03:15:58.613000
CVE-2025-13765,1,1,70a79c3df44b1d2bd17ed45daaa3c71e0fd532a568b67e455d024ef7b4aa662a,2025-11-27T16:15:47.387000
CVE-2025-13765,0,0,70a79c3df44b1d2bd17ed45daaa3c71e0fd532a568b67e455d024ef7b4aa662a,2025-11-27T16:15:47.387000
CVE-2025-1377,0,0,cdf3c00849797fee9786ea08188d37668b21a456809fa64aaace8c05203cfaf9,2025-11-04T20:26:20.043000
CVE-2025-1378,0,0,7b0b1440e8634b58b74747d3b86a48aac3845e3d771526460c32a15ff40576ad,2025-06-23T14:37:28.747000
CVE-2025-1379,0,0,5dcb3165f40d5545ed4ce19a6009cd3b7b7246346d15ef8a292528f915f8199d,2025-04-02T18:44:42.610000
@@ -299320,6 +299322,7 @@ CVE-2025-32606,0,0,102f2115c20e683f894ad16b60fd658c0335b2509302e397234daa0c641a9
CVE-2025-32607,0,0,38265bc8bf31e950ce0d9eddaae6c331e6d40d95828b1da783164822fca5392c,2025-04-11T15:39:52.920000
CVE-2025-32608,0,0,1ede76e7f96f83db14d84a23a082710253b42ae060e6c4804c3fdbecd3ceef9f,2025-04-17T20:21:05.203000
CVE-2025-32609,0,0,821ebc32984add689055aeedc6c31e34783fc6044e936e4f70933fd80b7d0458,2025-04-17T20:21:05.203000
CVE-2025-3261,1,1,580bdcd775da2ff48187788440c226d6d2ffbc6d69d820e2d4d730eb70f6fcbd,2025-11-27T18:15:46.403000
CVE-2025-32610,0,0,a25ad45796b5f5acd8ab3402331ea34b381a9f321b1c6d3cdae0171ab188d6c3,2025-04-09T20:02:41.860000
CVE-2025-32611,0,0,b2d699f7f4fad9acf828d34da8e4ca9587006829f4f3b01ec8641bb7c0e31e75,2025-04-17T20:21:05.203000
CVE-2025-32612,0,0,efa99a2dabb352d1a38ccde079a19aeda5059b5f0692fc1193c5fbb5935c1e14,2025-04-09T20:02:41.860000
@@ -309609,7 +309612,7 @@ CVE-2025-53176,0,0,d0007733595b5945fa414a854e602440e82442e74645c7488b9632b608831
CVE-2025-53177,0,0,b0be5d3bb33d219362f1f2fbeaa231f93668aaa0777efb34716d487d74e895a2,2025-08-12T14:39:19.227000
CVE-2025-53178,0,0,a0d7e67b0d2b525aa757acae538d17c5621a24c604f3024638a6a69c53ff5cf9,2025-08-12T14:39:35.227000
CVE-2025-53179,0,0,687550ad8868a1d17476346a82b7d07d767503d8b07be2e2e798efa81dc28f70,2025-07-09T19:14:21.773000
CVE-2025-5318,0,0,3ad06394dd675a63b948b229103de5458929d4ae48c9c88be5b9de3497059fd3,2025-11-20T22:16:00.117000
CVE-2025-5318,0,1,33b5546825657e4503299039c78c2270c395c7eab59b0eddb7ec6db577f68381,2025-11-27T18:15:46.597000
CVE-2025-53180,0,0,c9f05a94231e52dc6d3774f4bdc50538c22337601fe5b488c5b0a8c351c6fd84,2025-07-09T19:14:10.030000
CVE-2025-53181,0,0,2419fc3291eb2772102bc14c08da3d83c4e96505d343985f7f9ecf527f541e8f,2025-07-09T19:14:42.683000
CVE-2025-53182,0,0,da92e9428b462ef529e392e5f35d7f75e9329521d5a7c414dac29903a8aa72a7,2025-07-09T19:15:01.380000
Can't render this file because it is too large.