Auto-Update: 2025-03-16T15:00:20.111600+00:00

This commit is contained in:
cad-safe-bot 2025-03-16 15:03:48 +00:00
parent 293e5b4556
commit f9e21f6022
6 changed files with 457 additions and 10 deletions

View File

@ -2,13 +2,13 @@
"id": "CVE-2025-1211",
"sourceIdentifier": "report@snyk.io",
"published": "2025-02-11T05:15:14.013",
"lastModified": "2025-02-11T16:15:50.660",
"lastModified": "2025-03-16T13:15:36.813",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Versions of the package hackney from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://127.0.0.1?@127.2.2.2/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/. \rThis vulnerability can be exploited when users rely on the URL function for host checking."
"value": "Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://127.0.0.1?@127.2.2.2/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/. \rThis vulnerability can be exploited when users rely on the URL function for host checking."
},
{
"lang": "es",
@ -110,6 +110,10 @@
"url": "https://gist.github.com/snoopysecurity/996de09ec0cfd0ebdcfdda8ff515deb1",
"source": "report@snyk.io"
},
{
"url": "https://github.com/benoitc/hackney/commit/9594ce58fabd32cd897fc28fae937694515a3d4a",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-HEX-HACKNEY-6516131",
"source": "report@snyk.io"

View File

@ -0,0 +1,145 @@
{
"id": "CVE-2025-2338",
"sourceIdentifier": "cna@vuldb.com",
"published": "2025-03-16T13:15:37.827",
"lastModified": "2025-03-16T13:15:37.827",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, was found in tbeu matio 1.5.28. Affected is the function strdup_vprintf of the file src/io.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "cna@vuldb.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"baseScore": 7.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "cna@vuldb.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-119"
},
{
"lang": "en",
"value": "CWE-122"
}
]
}
],
"references": [
{
"url": "https://github.com/tbeu/matio/issues/269",
"source": "cna@vuldb.com"
},
{
"url": "https://github.com/tbeu/matio/issues/269#issue-2883920922",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?ctiid.299802",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?id.299802",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?submit.510781",
"source": "cna@vuldb.com"
}
]
}

View File

@ -0,0 +1,144 @@
{
"id": "CVE-2025-2339",
"sourceIdentifier": "cna@vuldb.com",
"published": "2025-03-16T13:15:38.003",
"lastModified": "2025-03-16T13:15:38.003",
"vulnStatus": "Received",
"cveTags": [
{
"sourceIdentifier": "cna@vuldb.com",
"tags": [
"unsupported-when-assigned"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in otale Tale Blog 2.0.5. It has been classified as problematic. This affects an unknown part of the file /%61dmin/api/logs. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "cna@vuldb.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"baseScore": 5.0,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "cna@vuldb.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"references": [
{
"url": "https://github.com/qkdjksfkeg/cve_article/blob/main/Tale/Unauthorized.md",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?ctiid.299805",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?id.299805",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?submit.511578",
"source": "cna@vuldb.com"
}
]
}

View File

@ -0,0 +1,148 @@
{
"id": "CVE-2025-2340",
"sourceIdentifier": "cna@vuldb.com",
"published": "2025-03-16T14:15:12.597",
"lastModified": "2025-03-16T14:15:12.597",
"vulnStatus": "Received",
"cveTags": [
{
"sourceIdentifier": "cna@vuldb.com",
"tags": [
"unsupported-when-assigned"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in otale Tale Blog 2.0.5. It has been declared as problematic. This vulnerability affects the function saveOptions of the file /options/save of the component Site Settings. The manipulation of the argument Site Title leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "cna@vuldb.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
"baseScore": 2.4,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 0.9,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N",
"baseScore": 3.3,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "MULTIPLE",
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"availabilityImpact": "NONE"
},
"baseSeverity": "LOW",
"exploitabilityScore": 6.4,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "cna@vuldb.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
},
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"references": [
{
"url": "https://github.com/qkdjksfkeg/cve_article/blob/main/Tale/XSS.md",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?ctiid.299806",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?id.299806",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?submit.514793",
"source": "cna@vuldb.com"
}
]
}

View File

@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2025-03-16T11:00:19.743584+00:00
2025-03-16T15:00:20.111600+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2025-03-16T10:15:25.793000+00:00
2025-03-16T14:15:12.597000+00:00
```
### Last Data Feed Release
@ -33,20 +33,23 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
285345
285348
```
### CVEs added in the last Commit
Recently added CVEs: `1`
Recently added CVEs: `3`
- [CVE-2025-2337](CVE-2025/CVE-2025-23xx/CVE-2025-2337.json) (`2025-03-16T10:15:25.793`)
- [CVE-2025-2338](CVE-2025/CVE-2025-23xx/CVE-2025-2338.json) (`2025-03-16T13:15:37.827`)
- [CVE-2025-2339](CVE-2025/CVE-2025-23xx/CVE-2025-2339.json) (`2025-03-16T13:15:38.003`)
- [CVE-2025-2340](CVE-2025/CVE-2025-23xx/CVE-2025-2340.json) (`2025-03-16T14:15:12.597`)
### CVEs modified in the last Commit
Recently modified CVEs: `0`
Recently modified CVEs: `1`
- [CVE-2025-1211](CVE-2025/CVE-2025-12xx/CVE-2025-1211.json) (`2025-03-16T13:15:36.813`)
## Download and Usage

View File

@ -281074,7 +281074,7 @@ CVE-2025-1207,0,0,2e207fe82a46faaf11a8c21d08133b4c3fe900fb7cb6fb92673f2816d05d2e
CVE-2025-1208,0,0,7d439f27be25af068ee7a5bdbb340ddd01d136ca5376da5fb603abe97482c28a,2025-02-21T12:03:49.027000
CVE-2025-1209,0,0,73163c928794f026d7174c939dfacce9c8a62bab67c5de9237fcf3ce185d0ff4,2025-02-19T19:04:43.770000
CVE-2025-1210,0,0,51f4cbb43c759e53b163b7aede54aac4df773ce5b490d7dce07597fb52fb1a4c,2025-02-19T19:03:10.870000
CVE-2025-1211,0,0,d6be1945cd848e3bcb8b408348b743023b743274fd86d11d3d8f2dd03fe57d4d,2025-02-11T16:15:50.660000
CVE-2025-1211,0,1,ed333afb6325a084c131f00ee087aa14b3435cac8d955152c6875f0fc0fc0275,2025-03-16T13:15:36.813000
CVE-2025-1212,0,0,4775d3c7abc8db0222566d77a07a3b283456acd669d779aebc898ec54ad5eb25,2025-02-12T15:15:18.290000
CVE-2025-1213,0,0,226c2da2d3a4aac647d77e7a97567bbe3f4fafbe21e513e404ff5a1441bfa553,2025-02-12T18:15:22.180000
CVE-2025-1214,0,0,ee530a0ccb2dbec34bd0adb6326677fa3eb44dee2c85c32f60f080d2175851ef,2025-02-12T20:15:39.200000
@ -283110,14 +283110,17 @@ CVE-2025-23366,0,0,19d3d492f06020aadbd27d64e622d5ed1c347260739b5074a05d263b32a74
CVE-2025-23367,0,0,7754a5b5a7ef7b20fc4ec39ada85296b1a92f1ca2476a6564c884bf68763656c,2025-01-31T21:15:13.613000
CVE-2025-23368,0,0,9c664fc0f9e7b340d6131cc859aefb9e94f28c0c73f7486f5208547e13f4025a,2025-03-04T16:15:39.270000
CVE-2025-23369,0,0,74f04427c8261f575e3b46a10e2c572c85dddb2e090b01cedc0f322610f8f68b,2025-02-05T19:15:45.747000
CVE-2025-2337,1,1,1bea57575dcbf4d8c20ecfdcc326ac9e1955617776c3e47359ed64a009bcb1d4,2025-03-16T10:15:25.793000
CVE-2025-2337,0,0,1bea57575dcbf4d8c20ecfdcc326ac9e1955617776c3e47359ed64a009bcb1d4,2025-03-16T10:15:25.793000
CVE-2025-23374,0,0,dc7fc0938dfddbb9f9d96945d0cf484d16ace6397f0b6d455113dea4502470b2,2025-02-07T20:09:28.717000
CVE-2025-2338,1,1,e1817d3bd4f3a2886eb379672293e26d61da3216de9706af1fbe1866b37f5783,2025-03-16T13:15:37.827000
CVE-2025-23384,0,0,d7685224b7a10743fe5eae6a1ebefcafcac773ad88bd00cac8b6407ed3adf454,2025-03-11T10:15:16.330000
CVE-2025-23385,0,0,44f68c3210fdb2f588e2b733b3276d4f924d74ac5df4660c1e28e1d2bd89eca2,2025-01-28T16:15:41.377000
CVE-2025-2339,1,1,afa9f41c145fa401320379508d9b5b5e05539d020c2ea1635094e22e6dc0961a,2025-03-16T13:15:38.003000
CVE-2025-23396,0,0,db4e35f65814d6895af1ea2102cd85328d5b692a5d5376b0f0f76fda3c3d1fa0,2025-03-11T10:15:16.670000
CVE-2025-23397,0,0,b39331b70d2d90745cf1ffdc79eae13a67bdd2a5914d5254d36092c6bef82b6d,2025-03-11T10:15:16.840000
CVE-2025-23398,0,0,06f6f7336d9ea782ecf8b7d22ce4427b70f63b9b90fe1843698322a5007cf4ed,2025-03-11T10:15:17.003000
CVE-2025-23399,0,0,e66db143849977e632a1a124fcc414710388ef65cb62a1f55b4d71ff26436fb5,2025-03-11T10:15:17.170000
CVE-2025-2340,1,1,2eb6ec780dd415eb7cddbda300af4f454e7143aea12afe3b447bfc929780d78e,2025-03-16T14:15:12.597000
CVE-2025-23400,0,0,b755ab97b14d8b740d82a6612ee133fbf20401fdc1734461b26bfa7a91c6fcd6,2025-03-11T10:15:17.340000
CVE-2025-23401,0,0,eb1c714c7e9d831c089f5fed48a6c73e9e71df48f5421115f3033bd2a0193a80,2025-03-11T10:15:17.510000
CVE-2025-23402,0,0,076d51d523d07583e5d9307add68f7b55e0d82f2216daeb4d8d036f63f4d832b,2025-03-11T10:15:17.680000

Can't render this file because it is too large.