Auto-Update: 2025-05-28T08:00:19.223224+00:00

This commit is contained in:
cad-safe-bot 2025-05-28 08:03:56 +00:00
parent eb2a834952
commit e71791cf3c
6 changed files with 231 additions and 25 deletions

View File

@ -0,0 +1,82 @@
{
"id": "CVE-2025-4009",
"sourceIdentifier": "research@onekey.com",
"published": "2025-05-28T07:15:24.490",
"lastModified": "2025-05-28T07:15:24.490",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Evertz SVDN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a\u00a0web management interface on port 80. This web management interface can be used by administrators to control product\nfeatures, setup network switching, and register license among other features. The application has been developed in PHP with\u00a0the webEASY SDK, also named \u2018ewb\u2019 by Evertz.\n\nThis web interface has two endpoints that are vulnerable to arbitrary command injection and the authentication mechanism has a flaw leading to authentication bypass.\n\nRemote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.\n\nThis level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "research@onekey.com",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:C/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NEGLIGIBLE",
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"valueDensity": "CONCENTRATED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
]
},
"weaknesses": [
{
"source": "research@onekey.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-77"
},
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"references": [
{
"url": "https://www.onekey.com/resource/security-advisory-remote-code-execution-on-evertz-svdn-cve-2025-4009",
"source": "research@onekey.com"
}
]
}

View File

@ -0,0 +1,68 @@
{
"id": "CVE-2025-4800",
"sourceIdentifier": "security@wordfence.com",
"published": "2025-05-28T06:15:22.000",
"lastModified": "2025-05-28T06:15:22.000",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm_lms_add_assignment_attachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-434"
}
]
}
],
"references": [
{
"url": "https://docs.stylemixthemes.com/masterstudy-lms/changelog-pro-version",
"source": "security@wordfence.com"
},
{
"url": "https://stylemixthemes.com/wordpress-lms-plugin/",
"source": "security@wordfence.com"
},
{
"url": "https://themeforest.net/item/masterstudy-education-center-wordpress-theme/12170274/",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c170a228-4abd-4ee6-ba37-bdcde1cb7fc5?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,29 @@
{
"id": "CVE-2025-4947",
"sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
"published": "2025-05-28T07:15:24.780",
"lastModified": "2025-05-28T07:15:24.780",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks."
}
],
"metrics": {},
"references": [
{
"url": "https://curl.se/docs/CVE-2025-4947.html",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9"
},
{
"url": "https://curl.se/docs/CVE-2025-4947.json",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9"
},
{
"url": "https://hackerone.com/reports/3150884",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9"
}
]
}

View File

@ -0,0 +1,29 @@
{
"id": "CVE-2025-5025",
"sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
"published": "2025-05-28T07:15:24.910",
"lastModified": "2025-05-28T07:15:24.910",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing."
}
],
"metrics": {},
"references": [
{
"url": "https://curl.se/docs/CVE-2025-5025.html",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9"
},
{
"url": "https://curl.se/docs/CVE-2025-5025.json",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9"
},
{
"url": "https://hackerone.com/reports/3153497",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9"
}
]
}

View File

@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2025-05-28T06:00:19.345483+00:00
2025-05-28T08:00:19.223224+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2025-05-28T04:15:50.207000+00:00
2025-05-28T07:15:24.910000+00:00
```
### Last Data Feed Release
@ -33,29 +33,23 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
295666
295670
```
### CVEs added in the last Commit
Recently added CVEs: `9`
Recently added CVEs: `4`
- [CVE-2023-41839](CVE-2023/CVE-2023-418xx/CVE-2023-41839.json) (`2025-05-28T04:15:31.777`)
- [CVE-2025-48841](CVE-2025/CVE-2025-488xx/CVE-2025-48841.json) (`2025-05-28T04:15:46.770`)
- [CVE-2025-48842](CVE-2025/CVE-2025-488xx/CVE-2025-48842.json) (`2025-05-28T04:15:47.390`)
- [CVE-2025-48843](CVE-2025/CVE-2025-488xx/CVE-2025-48843.json) (`2025-05-28T04:15:49.640`)
- [CVE-2025-48844](CVE-2025/CVE-2025-488xx/CVE-2025-48844.json) (`2025-05-28T04:15:49.917`)
- [CVE-2025-48845](CVE-2025/CVE-2025-488xx/CVE-2025-48845.json) (`2025-05-28T04:15:49.990`)
- [CVE-2025-48846](CVE-2025/CVE-2025-488xx/CVE-2025-48846.json) (`2025-05-28T04:15:50.067`)
- [CVE-2025-48847](CVE-2025/CVE-2025-488xx/CVE-2025-48847.json) (`2025-05-28T04:15:50.140`)
- [CVE-2025-48848](CVE-2025/CVE-2025-488xx/CVE-2025-48848.json) (`2025-05-28T04:15:50.207`)
- [CVE-2025-4009](CVE-2025/CVE-2025-40xx/CVE-2025-4009.json) (`2025-05-28T07:15:24.490`)
- [CVE-2025-4800](CVE-2025/CVE-2025-48xx/CVE-2025-4800.json) (`2025-05-28T06:15:22.000`)
- [CVE-2025-4947](CVE-2025/CVE-2025-49xx/CVE-2025-4947.json) (`2025-05-28T07:15:24.780`)
- [CVE-2025-5025](CVE-2025/CVE-2025-50xx/CVE-2025-5025.json) (`2025-05-28T07:15:24.910`)
### CVEs modified in the last Commit
Recently modified CVEs: `1`
Recently modified CVEs: `0`
- [CVE-2025-3714](CVE-2025/CVE-2025-37xx/CVE-2025-3714.json) (`2025-05-28T04:15:45.850`)
## Download and Usage

View File

@ -233728,7 +233728,7 @@ CVE-2023-41834,0,0,fe97b040b6a12d18159971f3ffafabcd5d8334236b35f116720f5f615708a
CVE-2023-41835,0,0,ce7155b465e140a8e62b26a8d6d86203572f5bdb055ed610039eae08c9aef2e1,2024-11-21T08:21:46.180000
CVE-2023-41836,0,0,c3f04a6ef80b01f6ac7cd2e69564f223dd13bbcf85e284392104bb6022b1b1d0,2024-11-21T08:21:46.330000
CVE-2023-41838,0,0,952c54aae683059d62b494aadea90c0936995fec7c2c31e60fa8e87d00501e21,2024-11-21T08:21:46.483000
CVE-2023-41839,1,1,7c22c7560745c0193919f9882c2fff0f3a5a0bd9a40ff759ac0ae75da9136afe,2025-05-28T04:15:31.777000
CVE-2023-41839,0,0,7c22c7560745c0193919f9882c2fff0f3a5a0bd9a40ff759ac0ae75da9136afe,2025-05-28T04:15:31.777000
CVE-2023-4184,0,0,60df463ab72975bdd1bf87dea9d6116251117803b12f9222b99bf19e9331ed2f,2024-11-21T08:34:34.303000
CVE-2023-41840,0,0,8d20f8abe065bcbe2c2d718ad7ceafc29f0c9c2f78c1e082d11032e68d2148f8,2024-11-21T08:21:46.637000
CVE-2023-41841,0,0,491f8782f84ae4bdd0c119a57acc5dfb8b3c40fff6f6761c378b72c883787aec,2024-11-21T08:21:46.777000
@ -292745,7 +292745,7 @@ CVE-2025-3710,0,0,0a7778bd78e4f22f022c252525488d49274bac6d5b6fae8773984217c6dc6e
CVE-2025-3711,0,0,4fd34b3efb29d679fc862ba489bdc27881bacd2c43f3c49bf4be0e93fc622083,2025-05-28T03:15:22.193000
CVE-2025-3712,0,0,ea56365e47ceb44e31dafb8f72bb0d4f1a8a74a514b3fc339176f713c23eafa1,2025-05-28T03:15:22.310000
CVE-2025-3713,0,0,7e67304534c06f2079db65e532178b0781d2814a48010fdc27d2a08fd7f43f29,2025-05-28T03:15:22.430000
CVE-2025-3714,0,1,3fcd28d3a7b81c31d305f49be6e84a00b4570b4ee1caa0904bee1851b94e6d66,2025-05-28T04:15:45.850000
CVE-2025-3714,0,0,3fcd28d3a7b81c31d305f49be6e84a00b4570b4ee1caa0904bee1851b94e6d66,2025-05-28T04:15:45.850000
CVE-2025-3715,0,0,2d1d9dba7f9eff4431b265f83f4af3c259cac9ce8ddae0a96ec092e646ca8d2a,2025-05-19T13:35:20.460000
CVE-2025-3723,0,0,477418a320dfd53a6e935f7e337452b515033da0e585c9ca76a1582be0b01b2c,2025-05-12T20:40:10.330000
CVE-2025-3724,0,0,18e69c1094bab55d0abc5efd07a77f5bb56c4db0cf848fa0037b08e463c287e2,2025-05-12T20:40:24.853000
@ -293481,6 +293481,7 @@ CVE-2025-4005,0,0,3395f342452d81fe28f72171670472e990a8955faacab9ea9a30fcbc3d4e23
CVE-2025-4006,0,0,b4863f9bca9c45c782eac4e0a8df6c153136ca75006dde5bfd67dbac13da0ed2,2025-04-29T13:52:10.697000
CVE-2025-4007,0,0,9777df4491741671ed8bb32daaef6bd13e88a3bc80a38f81c67c7e3aae15aace,2025-04-29T13:52:10.697000
CVE-2025-4008,0,0,f0130f878a53471d3fb1549dc09ccb4cbdfcbe18d257d761f05f6b646d258a62,2025-05-23T08:15:18.633000
CVE-2025-4009,1,1,a48f90cd6b7bf84b4f335a72c36b7bc833d628e392db355b6779faa98ed5af8b,2025-05-28T07:15:24.490000
CVE-2025-4011,0,0,3819550e074b2f97f25ec51252193290e9c87c0a28a7aedb206338328c0e7b76,2025-04-29T13:52:10.697000
CVE-2025-40114,0,0,18b151536edb74ce6ae0abb057cdaf2f657d28b31cc048efaafef211823a9957,2025-04-29T13:46:29.167000
CVE-2025-4012,0,0,36dc3f78b0e7e3ac1f05487215ef307e4a3550924eb6d25961b0b1557c98be91,2025-05-12T19:30:30.873000
@ -295164,6 +295165,7 @@ CVE-2025-47947,0,0,937e21e816ace6c7b2eea9b27977c70a0355dffa802eeb709a1580aec3fe9
CVE-2025-47948,0,0,ba2e8c1cb0258308d0310ef150246d3504511a8f7fe9ed640ab9013bfefadd52,2025-05-19T15:15:25.400000
CVE-2025-47949,0,0,dc86078901df64be63bcaee4a73ca319eec3de89fa5549a71818463921d49b3a,2025-05-21T20:25:16.407000
CVE-2025-4795,0,0,3fd0e28eaafb548c1d9f9e6a41da631ae960e10221f6f4901b1a5e253e1ad775,2025-05-19T13:35:20.460000
CVE-2025-4800,1,1,effbb959592fe4d51aa2f33071036fb2b9c5d78070f2c0d5ec37a9c50fcffec6,2025-05-28T06:15:22
CVE-2025-48009,0,0,f2f593603a23342f1ed10e6e06b800747a948e9a47401b873fcb7b9febb49dba,2025-05-21T20:24:58.133000
CVE-2025-48010,0,0,29ecfb7056487f862ce3f3d52a72af1a1c7498499e974227523a3feeadf25999,2025-05-21T20:24:58.133000
CVE-2025-48011,0,0,f7a7d415ad80812a779b1090cc64c6da9309fa4d9b5980d621fc83dfabfec97d,2025-05-21T20:24:58.133000
@ -295412,14 +295414,14 @@ CVE-2025-48827,0,0,a50f840283fd2bbc9a0c236b8e0a7afc67476d4ec5792331b9e1240a1d96c
CVE-2025-48828,0,0,7babaccf1c826448de50840a4963541ace772dfd59a97c487664d8dadaec9e30,2025-05-27T18:15:31.513000
CVE-2025-4883,0,0,5862fdd520821c1eedf697774db7196e34040fbccfc13f239bec6cec686b2e42,2025-05-21T19:38:13.727000
CVE-2025-4884,0,0,2d6b345f6687876df2d3e4cb744a5caa526ce300870cd564926a11af2bccc222,2025-05-19T13:35:20.460000
CVE-2025-48841,1,1,7f0e0c969efb3bef9720951c083cd77dcf55000205a06e477705e2d5154973aa,2025-05-28T04:15:46.770000
CVE-2025-48842,1,1,ba4bb2008ab25dba5eb316ee71e55945ac6c6e86998ead36e4c18bbc602b9af6,2025-05-28T04:15:47.390000
CVE-2025-48843,1,1,289fb4ccd51aa9f39fc7cb046c750bb2c9f1a40b8367b3b0a2c79fa22f4210f1,2025-05-28T04:15:49.640000
CVE-2025-48844,1,1,691afc4818b837f5124b1a7a449458230f6243d5fbc198f10ae02e1957b945fa,2025-05-28T04:15:49.917000
CVE-2025-48845,1,1,28c2c377a50b04054cbacd4d8a00509c2a1ec14792776b092a7a173a471a81fb,2025-05-28T04:15:49.990000
CVE-2025-48846,1,1,b4331e28b4548a0a81d0232dc77a343853591cec3e2f531b56c1d53501bb623a,2025-05-28T04:15:50.067000
CVE-2025-48847,1,1,b8563d91ba0679f627536816b3f17216a89f937d1a7db8c25b786323bd30235b,2025-05-28T04:15:50.140000
CVE-2025-48848,1,1,38731265ae915b14c5e915b02c11b0e53a54815641117da26fffd1c6f20ec7db,2025-05-28T04:15:50.207000
CVE-2025-48841,0,0,7f0e0c969efb3bef9720951c083cd77dcf55000205a06e477705e2d5154973aa,2025-05-28T04:15:46.770000
CVE-2025-48842,0,0,ba4bb2008ab25dba5eb316ee71e55945ac6c6e86998ead36e4c18bbc602b9af6,2025-05-28T04:15:47.390000
CVE-2025-48843,0,0,289fb4ccd51aa9f39fc7cb046c750bb2c9f1a40b8367b3b0a2c79fa22f4210f1,2025-05-28T04:15:49.640000
CVE-2025-48844,0,0,691afc4818b837f5124b1a7a449458230f6243d5fbc198f10ae02e1957b945fa,2025-05-28T04:15:49.917000
CVE-2025-48845,0,0,28c2c377a50b04054cbacd4d8a00509c2a1ec14792776b092a7a173a471a81fb,2025-05-28T04:15:49.990000
CVE-2025-48846,0,0,b4331e28b4548a0a81d0232dc77a343853591cec3e2f531b56c1d53501bb623a,2025-05-28T04:15:50.067000
CVE-2025-48847,0,0,b8563d91ba0679f627536816b3f17216a89f937d1a7db8c25b786323bd30235b,2025-05-28T04:15:50.140000
CVE-2025-48848,0,0,38731265ae915b14c5e915b02c11b0e53a54815641117da26fffd1c6f20ec7db,2025-05-28T04:15:50.207000
CVE-2025-4885,0,0,71690adb8bb16dc3b0abf632ff77fd8611dc09917588754b8c57e67fe3a44bd2,2025-05-19T13:35:20.460000
CVE-2025-4886,0,0,f0bc96dcd8776bcc92f543590bbb95ec4351295de136202b130c74e915ed1af1,2025-05-19T13:35:20.460000
CVE-2025-4887,0,0,a7b499ed3cdf6c879f3ec3b69793ad811740da88bfec778065c6ba52abd3d64a,2025-05-19T13:35:20.460000
@ -295477,6 +295479,7 @@ CVE-2025-4939,0,0,5ec31620a920403386badd8ed8c9ad70156a6e4853cf1462dcd01754dc60b7
CVE-2025-4940,0,0,2476264f5ca230e398816216f503ad21bd6ee0718fc81a3cc8e1ef1268a9a775,2025-05-21T20:25:16.407000
CVE-2025-4941,0,0,7ee6643b2dca5855a4c8910cf9fb3433ecd0901f54d071fbb7ffd69250830b9c,2025-05-28T01:31:03.773000
CVE-2025-4945,0,0,7c1921d824c0ffc4efae3fdac0f07df6ef4c8b0fbdbb004d6249658d4756d858,2025-05-21T20:25:16.407000
CVE-2025-4947,1,1,41b4309526023f35da5d8a9cbf74ea981242bfda1f99d26c1c00c59137d84ac7,2025-05-28T07:15:24.780000
CVE-2025-4948,0,0,dbe30938d8190315dbaa2e8d5919e8362721c3330df496b34aaab2abe9515761,2025-05-26T12:15:23.963000
CVE-2025-4949,0,0,c11b53f05ae94538ba622256f90c8d8b1286550f417cb15b7dccd733b074e027,2025-05-23T07:15:21.160000
CVE-2025-4951,0,0,8d2965f90ffa46a261e1b06cd533aeb358abbd5115dc1f57a5b34acf12ab582b,2025-05-21T20:25:16.407000
@ -295504,6 +295507,7 @@ CVE-2025-5011,0,0,d1caeeaa784d143902e41e16fc8809733bc411c4665df188f33764965bcab2
CVE-2025-5013,0,0,9e2206cee3d9a4da13b7d790d61a24286d0c704fc74b7b095d3cf27be2eea613,2025-05-21T23:15:55.563000
CVE-2025-5020,0,0,8e92e81268cb02470f5321fbe111bd1217491079f6b87fc538686f0917f7768a,2025-05-21T20:24:58.133000
CVE-2025-5024,0,0,ccdd8a7db520a87487d39e567caff85e7e094c68165b88263d5456db37c53d13,2025-05-23T15:55:02.040000
CVE-2025-5025,1,1,7453e6923eb1a45f61a94bcc35c54f4d6c6e3d7ea83c8b1a686b8ff6ef78a86a,2025-05-28T07:15:24.910000
CVE-2025-5029,0,0,ecb9afcd5e588564920b0ea2535593ae37c1896d06cac3ff8323350bc3b94721,2025-05-21T20:24:58.133000
CVE-2025-5030,0,0,524bdc59d3cf3de128931a2064721f0c18eb0893fa1e7a140dbc00738f726523,2025-05-21T20:24:58.133000
CVE-2025-5031,0,0,5f2ab8d2bd00dbf44f07508d2176837c7f0d7e14295892849ea6ba136599d0aa,2025-05-21T20:24:58.133000

Can't render this file because it is too large.