diff --git a/CVE-2025/CVE-2025-141xx/CVE-2025-14184.json b/CVE-2025/CVE-2025-141xx/CVE-2025-14184.json new file mode 100644 index 00000000000..3e59d3c5f05 --- /dev/null +++ b/CVE-2025/CVE-2025-141xx/CVE-2025-14184.json @@ -0,0 +1,153 @@ +{ + "id": "CVE-2025-14184", + "sourceIdentifier": "cna@vuldb.com", + "published": "2025-12-07T05:15:49.747", + "lastModified": "2025-12-07T05:15:49.747", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability was determined in SGAI Space1 NAS N1211DS up to 1.0.915. Impacted is the function RENAME_FILE/OPERATE_FILE/NGNIX_UPLOAD of the file /cgi-bin/JSONAPI of the component gsaiagent. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way." + } + ], + "metrics": { + "cvssMetricV40": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", + "baseScore": 5.3, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "LOW", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "PROOF_OF_CONCEPT", + "confidentialityRequirement": "NOT_DEFINED", + "integrityRequirement": "NOT_DEFINED", + "availabilityRequirement": "NOT_DEFINED", + "modifiedAttackVector": "NOT_DEFINED", + "modifiedAttackComplexity": "NOT_DEFINED", + "modifiedAttackRequirements": "NOT_DEFINED", + "modifiedPrivilegesRequired": "NOT_DEFINED", + "modifiedUserInteraction": "NOT_DEFINED", + "modifiedVulnConfidentialityImpact": "NOT_DEFINED", + "modifiedVulnIntegrityImpact": "NOT_DEFINED", + "modifiedVulnAvailabilityImpact": "NOT_DEFINED", + "modifiedSubConfidentialityImpact": "NOT_DEFINED", + "modifiedSubIntegrityImpact": "NOT_DEFINED", + "modifiedSubAvailabilityImpact": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED" + } + } + ], + "cvssMetricV31": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseScore": 6.3, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "LOW" + }, + "exploitabilityScore": 2.8, + "impactScore": 3.4 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", + "baseScore": 6.5, + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "SINGLE", + "confidentialityImpact": "PARTIAL", + "integrityImpact": "PARTIAL", + "availabilityImpact": "PARTIAL" + }, + "baseSeverity": "MEDIUM", + "exploitabilityScore": 8.0, + "impactScore": 6.4, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-74" + }, + { + "lang": "en", + "value": "CWE-77" + } + ] + } + ], + "references": [ + { + "url": "https://vuldb.com/?ctiid.334604", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.334604", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?submit.698568", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?submit.698569", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?submit.698570", + "source": "cna@vuldb.com" + }, + { + "url": "https://www.notion.so/2b16cf4e528a80858abbf62b721a54b0", + "source": "cna@vuldb.com" + }, + { + "url": "https://www.notion.so/2b16cf4e528a80f2ada9dc83651a4013", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2025/CVE-2025-141xx/CVE-2025-14185.json b/CVE-2025/CVE-2025-141xx/CVE-2025-14185.json new file mode 100644 index 00000000000..14e96b208ed --- /dev/null +++ b/CVE-2025/CVE-2025-141xx/CVE-2025-14185.json @@ -0,0 +1,141 @@ +{ + "id": "CVE-2025-14185", + "sourceIdentifier": "cna@vuldb.com", + "published": "2025-12-07T05:15:59.987", + "lastModified": "2025-12-07T05:15:59.987", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability was identified in Yonyou U8 Cloud 5.0/5.0sp/5.1/5.1sp. The affected element is an unknown function of the file nc/pubitf/erm/mobile/appservice/AppServletService.class. Such manipulation of the argument usercode leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way." + } + ], + "metrics": { + "cvssMetricV40": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", + "baseScore": 5.3, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "NONE", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "LOW", + "vulnAvailabilityImpact": "LOW", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "NONE", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "PROOF_OF_CONCEPT", + "confidentialityRequirement": "NOT_DEFINED", + "integrityRequirement": "NOT_DEFINED", + "availabilityRequirement": "NOT_DEFINED", + "modifiedAttackVector": "NOT_DEFINED", + "modifiedAttackComplexity": "NOT_DEFINED", + "modifiedAttackRequirements": "NOT_DEFINED", + "modifiedPrivilegesRequired": "NOT_DEFINED", + "modifiedUserInteraction": "NOT_DEFINED", + "modifiedVulnConfidentialityImpact": "NOT_DEFINED", + "modifiedVulnIntegrityImpact": "NOT_DEFINED", + "modifiedVulnAvailabilityImpact": "NOT_DEFINED", + "modifiedSubConfidentialityImpact": "NOT_DEFINED", + "modifiedSubIntegrityImpact": "NOT_DEFINED", + "modifiedSubAvailabilityImpact": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED" + } + } + ], + "cvssMetricV31": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseScore": 6.3, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "LOW" + }, + "exploitabilityScore": 2.8, + "impactScore": 3.4 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", + "baseScore": 6.5, + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "SINGLE", + "confidentialityImpact": "PARTIAL", + "integrityImpact": "PARTIAL", + "availabilityImpact": "PARTIAL" + }, + "baseSeverity": "MEDIUM", + "exploitabilityScore": 8.0, + "impactScore": 6.4, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-74" + }, + { + "lang": "en", + "value": "CWE-89" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/798xuezhiqian-collab/vuln01", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?ctiid.334605", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.334605", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?submit.698601", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/README.md b/README.md index aab28366b20..a161212fb53 100644 --- a/README.md +++ b/README.md @@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2025-12-07T05:00:10.940713+00:00 +2025-12-07T07:00:12.160842+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2025-12-07T03:15:59.890000+00:00 +2025-12-07T05:15:59.987000+00:00 ``` ### Last Data Feed Release @@ -33,15 +33,15 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### Total Number of included CVEs ```plain -320445 +320447 ``` ### CVEs added in the last Commit Recently added CVEs: `2` -- [CVE-2025-14182](CVE-2025/CVE-2025-141xx/CVE-2025-14182.json) (`2025-12-07T03:15:58.340`) -- [CVE-2025-14183](CVE-2025/CVE-2025-141xx/CVE-2025-14183.json) (`2025-12-07T03:15:59.890`) +- [CVE-2025-14184](CVE-2025/CVE-2025-141xx/CVE-2025-14184.json) (`2025-12-07T05:15:49.747`) +- [CVE-2025-14185](CVE-2025/CVE-2025-141xx/CVE-2025-14185.json) (`2025-12-07T05:15:59.987`) ### CVEs modified in the last Commit diff --git a/_state.csv b/_state.csv index 603724d2dda..9e3125bfa5b 100644 --- a/_state.csv +++ b/_state.csv @@ -288925,8 +288925,10 @@ CVE-2025-1415,0,0,f05beafdb83e18bb7b33e571be7eadd19247e66c15eab1dff15b2be318c7e5 CVE-2025-1416,0,0,bf6b71b475605ad7a97ab671155ae31bd7a7ee4e526491c519770dc2917f5efc,2025-05-21T20:24:58.133000 CVE-2025-1417,0,0,545448b9375d427d2a57ae458efdab3c4eebfc89833f76f026bc371dadc42675,2025-05-21T20:24:58.133000 CVE-2025-1418,0,0,46cf18557977218c322793b5082adeccfbc2371955a95e3041f7e935915bd683,2025-05-21T20:24:58.133000 -CVE-2025-14182,1,1,f0001e7392a166139d7f41af33c3dc3897da941b5e9ea3f0fe998d61a768325a,2025-12-07T03:15:58.340000 -CVE-2025-14183,1,1,f7ed52500fd1cb28453ccd5b11cc04746edba5cf93d5501c4ba37cfada9ebbd5,2025-12-07T03:15:59.890000 +CVE-2025-14182,0,0,f0001e7392a166139d7f41af33c3dc3897da941b5e9ea3f0fe998d61a768325a,2025-12-07T03:15:58.340000 +CVE-2025-14183,0,0,f7ed52500fd1cb28453ccd5b11cc04746edba5cf93d5501c4ba37cfada9ebbd5,2025-12-07T03:15:59.890000 +CVE-2025-14184,1,1,524957360f5777def92d28ea083b12beb7067fb92f332f11004d1d4e8a62f01e,2025-12-07T05:15:49.747000 +CVE-2025-14185,1,1,2b6126c1b8a1b3eb4133e641bfa50d0d6e3d015e34b4773b0252a80169dd42d9,2025-12-07T05:15:59.987000 CVE-2025-1419,0,0,e9b4383dce54deb76ffaf62b71b6b865744947936f83af1607900da4a145d1c2,2025-05-21T20:24:58.133000 CVE-2025-1420,0,0,a6998f135128559a737cd848d0b746894ad1be48194a738c284f0e29cf433dc9,2025-05-21T20:24:58.133000 CVE-2025-1421,0,0,0a3d6c3aba2bddc77519fcb05e69f19c0ac462cf78e75eacd7e9a86f57340345,2025-05-21T20:24:58.133000