From 20b16cdb4cf07658b8c3a7d679dc5bcfefb42c60 Mon Sep 17 00:00:00 2001 From: Vulnerability Bot Date: Sat, 14 Nov 2026 01:50:24 +0100 Subject: [PATCH] NVD update 2026-11-14T00:50:17Z --- data/2024/CVE-2024-58405.json | 2 +- data/2024/CVE-2024-58406.json | 2 +- data/2025/CVE-2025-0008.json | 2 +- data/2025/CVE-2025-0027.json | 2 +- data/2025/CVE-2025-0043.json | 2 +- data/2025/CVE-2025-10248.json | 2 +- data/2025/CVE-2025-10698.json | 2 +- data/2025/CVE-2025-10935.json | 2 +- data/2025/CVE-2025-13353.json | 2 +- data/2025/CVE-2025-15711.json | 2 +- data/2025/CVE-2025-15712.json | 2 +- data/2025/CVE-2025-15713.json | 2 +- data/2025/CVE-2025-15714.json | 2 +- data/2025/CVE-2025-29940.json | 2 +- data/2025/CVE-2025-29941.json | 2 +- data/2025/CVE-2025-41725.json | 2 +- data/2025/CVE-2025-48504.json | 2 +- data/2025/CVE-2025-52535.json | 2 +- data/2025/CVE-2025-52537.json | 2 +- data/2025/CVE-2025-54501.json | 2 +- data/2025/CVE-2025-54503.json | 2 +- data/2025/CVE-2025-54504.json | 2 +- data/2025/CVE-2025-54506.json | 2 +- data/2025/CVE-2025-54507.json | 2 +- data/2025/CVE-2025-54508.json | 2 +- data/2025/CVE-2025-59847.json | 2 +- data/2025/CVE-2025-59848.json | 2 +- data/2025/CVE-2025-61625.json | 2 +- data/2025/CVE-2025-62620.json | 2 +- data/2025/CVE-2025-62621.json | 2 +- data/2025/CVE-2025-71459.json | 2 +- data/2025/CVE-2025-71460.json | 2 +- data/2025/CVE-2025-71461.json | 2 +- data/2025/CVE-2025-71462.json | 2 +- data/2025/CVE-2025-71463.json | 2 +- data/2026/CVE-2026-119077.json | 2 +- data/2026/CVE-2026-121518.json | 2 +- data/2026/CVE-2026-124002.json | 2 +- data/2026/CVE-2026-124006.json | 2 +- data/2026/CVE-2026-124010.json | 2 +- data/2026/CVE-2026-124014.json | 2 +- data/2026/CVE-2026-124666.json | 2 +- data/2026/CVE-2026-124679.json | 2 +- data/2026/CVE-2026-124680.json | 2 +- data/2026/CVE-2026-124716.json | 2 +- data/2026/CVE-2026-124719.json | 2 +- data/2026/CVE-2026-124723.json | 2 +- data/2026/CVE-2026-124726.json | 2 +- data/2026/CVE-2026-125055.json | 2 +- data/2026/CVE-2026-126190.json | 2 +- data/2026/CVE-2026-126206.json | 2 +- data/2026/CVE-2026-126210.json | 2 +- data/2026/CVE-2026-126266.json | 2 +- data/2026/CVE-2026-126270.json | 2 +- data/2026/CVE-2026-126278.json | 2 +- data/2026/CVE-2026-126286.json | 2 +- data/2026/CVE-2026-126294.json | 2 +- data/2026/CVE-2026-126298.json | 2 +- data/2026/CVE-2026-126358.json | 2 +- data/2026/CVE-2026-126366.json | 2 +- data/2026/CVE-2026-126395.json | 2 +- data/2026/CVE-2026-126955.json | 2 +- data/2026/CVE-2026-127029.json | 2 +- data/2026/CVE-2026-127076.json | 2 +- data/2026/CVE-2026-12708.json | 2 +- data/2026/CVE-2026-127080.json | 2 +- data/2026/CVE-2026-127088.json | 2 +- data/2026/CVE-2026-127275.json | 2 +- data/2026/CVE-2026-127279.json | 2 +- data/2026/CVE-2026-127284.json | 2 +- data/2026/CVE-2026-128134.json | 1 + data/2026/CVE-2026-128238.json | 2 +- data/2026/CVE-2026-128239.json | 2 +- data/2026/CVE-2026-128242.json | 2 +- data/2026/CVE-2026-128339.json | 2 +- data/2026/CVE-2026-128343.json | 2 +- data/2026/CVE-2026-128347.json | 2 +- data/2026/CVE-2026-129173.json | 1 + data/2026/CVE-2026-129180.json | 1 + data/2026/CVE-2026-45265.json | 2 +- data/2026/CVE-2026-47259.json | 2 +- data/2026/CVE-2026-71519.json | 1 + data/2026/CVE-2026-71531.json | 1 + data/2026/CVE-2026-95651.json | 2 +- state/sync.json | 2 +- 85 files changed, 85 insertions(+), 80 deletions(-) create mode 100644 data/2026/CVE-2026-128134.json create mode 100644 data/2026/CVE-2026-129173.json create mode 100644 data/2026/CVE-2026-129180.json create mode 100644 data/2026/CVE-2026-71519.json create mode 100644 data/2026/CVE-2026-71531.json diff --git a/data/2024/CVE-2024-58405.json b/data/2024/CVE-2024-58405.json index e0bf2e5449..3a9acf85a0 100644 --- a/data/2024/CVE-2024-58405.json +++ b/data/2024/CVE-2024-58405.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"3.7.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files."}],"id":"CVE-2024-58405","lastModified":"2026-11-13T10:17:23.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:23.610","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-3.7.9-invite-bypass-via-api-auth-register-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"3.7.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files."}],"id":"CVE-2024-58405","lastModified":"2026-11-13T23:17:12.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-58405","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:47.962720Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:23.610","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-j2cw-9fvc-wr4r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-3.7.9-invite-bypass-via-api-auth-register-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2024/CVE-2024-58406.json b/data/2024/CVE-2024-58406.json index cee8c474ad..0eae53bc7f 100644 --- a/data/2024/CVE-2024-58406.json +++ b/data/2024/CVE-2024-58406.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Huatian Dynamic OA8000","vendor":"Dalian Huatian Software Co., Ltd.","versions":[{"status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request parameter is used to locate a file without restricting access to an intended directory or rejecting traversal sequences. Attackers can supply ../ sequences to read arbitrary files from the server, such as the Tomcat configuration at ROOT/WEB-INF/web.xml, exposing sensitive configuration, source, and credential material that can enable further compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-20."}],"id":"CVE-2024-58406","lastModified":"2026-11-13T21:17:34.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-58406","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T21:08:04.608383Z","version":"2.0.3"}}]},"published":"2026-11-13T16:17:18.497","references":[{"source":"disclosure@vulncheck.com","url":"https://cn-sec.com/archives/2540697.html"},{"source":"disclosure@vulncheck.com","url":"https://www.oa8000.com/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/huatian-oa8000-path-traversal-via-ntkodownload-jsp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Huatian Dynamic OA8000","vendor":"Dalian Huatian Software Co., Ltd.","versions":[{"status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request parameter is used to locate a file without restricting access to an intended directory or rejecting traversal sequences. Attackers can supply ../ sequences to read arbitrary files from the server, such as the Tomcat configuration at ROOT/WEB-INF/web.xml, exposing sensitive configuration, source, and credential material that can enable further compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-20."},{"lang":"es","value":"El sistema de oficina colaborativa Huatian Dynamic OA8000 contiene una vulnerabilidad de salto de directorio (path traversal) no autenticado en /OAapp/jsp/trace/ntkodownload.jsp, donde el parámetro de solicitud filename se utiliza para localizar un archivo sin restringir el acceso al directorio previsto ni rechazar secuencias de salto de ruta. Los atacantes pueden suministrar secuencias .. / para leer archivos arbitrarios del servidor, como la configuración de Tomcat en ROOT/WEB-INF/web.xml, exponiendo configuración sensible, código fuente y credenciales que pueden facilitar un compromiso mayor. La evidencia de explotación fue observada por primera vez por The Shadowserver Foundation el 20 de noviembre de 2024."}],"id":"CVE-2024-58406","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-58406","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T21:08:04.608383Z","version":"2.0.3"}}]},"published":"2026-11-13T16:17:18.497","references":[{"source":"disclosure@vulncheck.com","url":"https://cn-sec.com/archives/2540697.html"},{"source":"disclosure@vulncheck.com","url":"https://www.oa8000.com/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/huatian-oa8000-path-traversal-via-ntkodownload-jsp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-0008.json b/data/2025/CVE-2025-0008.json index e8ce251539..5040c53996 100644 --- a/data/2025/CVE-2025-0008.json +++ b/data/2025/CVE-2025-0008.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI 1.0.0.G"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"RomePI-SP3_1.0.0.Q"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7001 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"NaplesPI-SP3_1.0.0.T"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"},{"status":"unaffected","version":"CastlePeakWSPI-sWRX8 1.0.0.I"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4 1.0.0.10"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedRomePI-SP3 1.0.0.G"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"SnowyOwl_SP4_SP4r2.1.1.0.I"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentially resulting in unauthorized debug access."},{"lang":"es","value":"La verificación insuficiente de la autenticidad de los datos puede permitir a un atacante local bypassar Secure Debug Unlock (SDU), lo que podría provocar acceso no autorizado a la depuración."}],"id":"CVE-2025-0008","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0008","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:49:03.958779Z","version":"2.0.3"}}]},"published":"2026-11-10T23:17:18.703","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3049.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI 1.0.0.G"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"RomePI-SP3_1.0.0.Q"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7001 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"NaplesPI-SP3_1.0.0.T"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"},{"status":"unaffected","version":"CastlePeakWSPI-sWRX8 1.0.0.I"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4 1.0.0.10"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedRomePI-SP3 1.0.0.G"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"SnowyOwl_SP4_SP4r2.1.1.0.I"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentially resulting in unauthorized debug access."},{"lang":"es","value":"Una verificación insuficiente de la autenticidad de los datos podría permitir a un atacante local eludir Secure Debug Unlock (SDU), lo que potencialmente resultaría en un acceso de depuración no autorizado."}],"id":"CVE-2025-0008","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0008","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:49:03.958779Z","version":"2.0.3"}}]},"published":"2026-11-10T23:17:18.703","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3049.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-0027.json b/data/2025/CVE-2025-0027.json index 306057f1ae..e9824d554d 100644 --- a/data/2025/CVE-2025-0027.json +++ b/data/2025/CVE-2025-0027.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Reverse Map Table (RMP) protections, potentially impacting the integrity of Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest memory."}],"id":"CVE-2025-0027","lastModified":"2026-11-13T00:20:03.990","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0027","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:45:31.765095Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:44.427","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Reverse Map Table (RMP) protections, potentially impacting the integrity of Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest memory."},{"lang":"es","value":"Un control de acceso inadecuado en el firmware de AMD Secure Encrypted Virtualization (SEV) podría permitir a un hipervisor malicioso eludir las protecciones de la Reverse Map Table (RMP), afectando potencialmente a la integridad de la memoria del huésped en Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP)."}],"id":"CVE-2025-0027","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0027","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:45:31.765095Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:44.427","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-0043.json b/data/2025/CVE-2025-0043.json index 6943b5514f..791921a2e2 100644 --- a/data/2025/CVE-2025-0043.json +++ b/data/2025/CVE-2025-0043.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Vivado Software","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially resulting in arbitrary code execution."},{"lang":"es","value":"Incorrectos permisos de directorio dentro de AMD Vivado™ Lab Solutions podrían permitir a un atacante local-privilegiado que se encuentra en el sistema de ejecutar código arbitrario potencialmente.\n\nNota: En la traducción original, se indicó que la vulnerabilidad podría resultar en una ejecución de código arbitrario, por lo que se mantuvieron las mismas palabras para evitar la pérdida de información.\n\nNota: Aunque la traducción se basa en el texto proporcionado, se puede sugerir que se puede realizar una mejor traducción, como “ ejecución de código arbitraria”, en lugar de ”ejecución de código arbitrario"}],"id":"CVE-2025-0043","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0043","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:15:36.585880Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:13.827","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8024.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Vivado Software","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially resulting in arbitrary code execution."},{"lang":"es","value":"Permisos de directorio incorrectos en AMD Vivado Lab Solutions podrían permitir a un atacante local con privilegios de usuario elevar sus privilegios, lo que potencialmente resultaría en la ejecución de código arbitrario."}],"id":"CVE-2025-0043","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0043","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:15:36.585880Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:13.827","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8024.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-10248.json b/data/2025/CVE-2025-10248.json index c664fb2286..67958b451d 100644 --- a/data/2025/CVE-2025-10248.json +++ b/data/2025/CVE-2025-10248.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Filr","vendor":"OpenText","versions":[{"changes":[{"at":"25.4","status":"unaffected"}],"lessThanOrEqual":"25.1.2","status":"affected","version":"0","versionType":"Server"}]}],"source":"security@opentext.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS attack."}],"id":"CVE-2025-10248","lastModified":"2026-11-10T21:46:41.003","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"source":"security@opentext.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-10248","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:27:30.589692Z","version":"2.0.3"}}]},"published":"2026-11-09T16:17:23.973","references":[{"source":"security@opentext.com","url":"https://my.opentext.com/support/article/11802664"}],"sourceIdentifier":"security@opentext.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@opentext.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Filr","vendor":"OpenText","versions":[{"changes":[{"at":"25.4","status":"unaffected"}],"lessThanOrEqual":"25.1.2","status":"affected","version":"0","versionType":"Server"}]}],"source":"security@opentext.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS attack."},{"lang":"es","value":"Una vulnerabilidad de Cross-Site Scripting (XSS) en OpenText Filr Appliance hasta la versión 25.1.2 podría permitir a un usuario autenticado subir un archivo malicioso y ejecutar un ataque de XSS almacenado."}],"id":"CVE-2025-10248","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"source":"security@opentext.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-10248","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:27:30.589692Z","version":"2.0.3"}}]},"published":"2026-11-09T16:17:23.973","references":[{"source":"security@opentext.com","url":"https://my.opentext.com/support/article/11802664"}],"sourceIdentifier":"security@opentext.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@opentext.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-10698.json b/data/2025/CVE-2025-10698.json index 6dafad1844..1582bae5f7 100644 --- a/data/2025/CVE-2025-10698.json +++ b/data/2025/CVE-2025-10698.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows","Linux","64 bit"],"product":"Identity Console","vendor":"OpenText","versions":[{"changes":[{"at":"25.2","status":"unaffected"}],"lessThan":"25.2","status":"affected","version":"1.8","versionType":"rpm, exe"}]}],"source":"security@opentext.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect default permissions and Product released in Non-Release configuration vulnerability in OpenText Identity Console on Windows, Linux, and 64 bit allows Retrieve Embedded Sensitive Data.\n\nThis issue affects Identity Console: from 1.8 through 25.2."}],"id":"CVE-2025-10698","lastModified":"2026-11-12T17:17:20.973","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:L/U:Amber","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"LOW"},"source":"security@opentext.com","type":"Secondary"}]},"published":"2026-11-12T17:17:20.800","references":[{"source":"security@opentext.com","url":"https://docs.microfocus.com/doc/29/25.4/securityandsoftwarefixes"}],"sourceIdentifier":"security@opentext.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"},{"lang":"en","value":"CWE-1269"}],"source":"security@opentext.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows","Linux","64 bit"],"product":"Identity Console","vendor":"OpenText","versions":[{"changes":[{"at":"25.2","status":"unaffected"}],"lessThan":"25.2","status":"affected","version":"1.8","versionType":"rpm, exe"}]}],"source":"security@opentext.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect default permissions and Product released in Non-Release configuration vulnerability in OpenText Identity Console on Windows, Linux, and 64 bit allows Retrieve Embedded Sensitive Data.\n\nThis issue affects Identity Console: from 1.8 through 25.2."},{"lang":"es","value":"Una vulnerabilidad de permisos predeterminados incorrectos y publicación de producto en configuración de no producción en OpenText Identity Console en Windows y Linux (64 bits) permite recuperar datos sensibles embebidos.\n\nEste problema afecta a Identity Console: desde la versión 1.8 hasta la 25.2."}],"id":"CVE-2025-10698","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:L/U:Amber","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"LOW"},"source":"security@opentext.com","type":"Secondary"}]},"published":"2026-11-12T17:17:20.800","references":[{"source":"security@opentext.com","url":"https://docs.microfocus.com/doc/29/25.4/securityandsoftwarefixes"}],"sourceIdentifier":"security@opentext.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"},{"lang":"en","value":"CWE-1269"}],"source":"security@opentext.com","type":"Primary"}]} diff --git a/data/2025/CVE-2025-10935.json b/data/2025/CVE-2025-10935.json index 6331b1804e..e874f586b3 100644 --- a/data/2025/CVE-2025-10935.json +++ b/data/2025/CVE-2025-10935.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"libilbm","vendor":"libilbm","versions":[{"status":"affected","version":"3.0.4"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libilbm. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of ILBM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27792."},{"lang":"es","value":"La vulnerabilidad de libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution. Esta vulnerabilidad permite a los atacantes remotos ejecutar código arbitrario en instalaciones afectadas de libilbm. La interacción del usuario es necesaria para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nEl fallo específico se encuentra en el procesamiento de archivos ILBM. El problema se debe a la falta de validación adecuada de la longitud de los datos suministrados por el usuario antes de copiarlos a un búfer basado en la pila. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-27792."}],"id":"CVE-2025-10935","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.107","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-887/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"libilbm","vendor":"libilbm","versions":[{"status":"affected","version":"3.0.4"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libilbm. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of ILBM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27792."},{"lang":"es","value":"Vulnerabilidad de ejecución remota de código por desbordamiento de búfer basado en memoria dinámica (heap) en el análisis sintáctico de archivos ILBM en libilbm. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas de libilbm. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nEl fallo específico existe dentro del análisis de archivos ILBM. El problema se debe a la falta de validación adecuada de la longitud de los datos suministrados por el usuario antes de copiarlos en un búfer basado en memoria dinámica (heap). Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Anteriormente identificado como ZDI-CAN-27792."}],"id":"CVE-2025-10935","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.107","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-887/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2025/CVE-2025-13353.json b/data/2025/CVE-2025-13353.json index 25dddcd7f9..ef7a04a994 100644 --- a/data/2025/CVE-2025-13353.json +++ b/data/2025/CVE-2025-13353.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"github.com/cloudflare/gokey","product":"gokey","repo":"https://github.com/cloudflare/gokey","vendor":"Cloudflare","versions":[{"lessThan":"0.2.0","status":"affected","version":"0.1.0","versionType":"semver"}]}],"source":"cna@cloudflare.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cloudflare:gokey:*:*:*:*:*:go:*:*","matchCriteriaId":"A8FEAB32-4588-4479-BCCA-5253FE85DB69","versionEndExcluding":"0.2.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In gokey versions <0.2.0,\n a flaw in the seed decryption logic resulted in passwords incorrectly \nbeing derived solely from the initial vector and the AES-GCM \nauthentication tag of the key seed.\n\n\nThis issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any passwords/secrets that were derived from the seed file (using the -s option). Even if the input seed file stays the same, version 0.2.0 gokey will generate different secrets.\n\n\nImpact\nThis vulnerability impacts generated keys/secrets using a seed file as an entropy input (using the -s option). Keys/secrets generated just from the master password (without the -s\n option) are not impacted. The confidentiality of the seed itself is \nalso not impacted (it is not required to regenerate the seed itself). \nSpecific impact includes:\n\n\n\n * keys/secrets generated from a seed file may have lower entropy: it \nwas expected that the whole seed would be used to generate keys (240 \nbytes of entropy input), where in vulnerable versions only 28 bytes was \nused\n\n * a malicious entity could have recovered all passwords, generated \nfrom a particular seed, having only the seed file in possession without \nthe knowledge of the seed master password\n\n\n\n\nPatches\nThe code logic bug has been fixed in gokey version 0.2.0\n and above. Due to the deterministic nature of gokey, fixed versions \nwill produce different passwords/secrets using seed files, as all seed \nentropy will be used now.\n\n\nSystem secret rotation guidance\nIt is advised for users to regenerate passwords/secrets using the patched version of gokey (0.2.0\n and above), and provision/rotate these secrets into respective systems \nin place of the old secret. A specific rotation procedure is \nsystem-dependent, but most common patterns are described below.\n\n\nSystems that do not require the old password/secret for rotation\nSuch systems usually have a \"Forgot password\" facility or a\n similar facility allowing users to rotate their password/secrets by \nsending a unique \"magic\" link to the user's email or phone. In such \ncases users are advised to use this facility and input the newly \ngenerated password secret, when prompted by the system.\n\n\nSystems that require the old password/secret for rotation\nSuch systems usually have a modal password rotation window\n usually in the user settings section requiring the user to input the \nold and the new password sometimes with a confirmation. To \ngenerate/recover the old password in such cases users are advised to:\n\n\n\n * temporarily download gokey version 0.1.3 https://github.com/cloudflare/gokey/releases/tag/v0.1.3 for their respective operating system to recover the old password\n\n * use gokey version 0.2.0 or above to generate the new password\n\n * populate the system provided password rotation form\n\n\n\n\nSystems that allow multiple credentials for the same account to be provisioned\nSuch systems usually require a secret or a cryptographic \nkey as a credential for access, but allow several credentials at the \nsame time. One example is SSH: a particular user may have several \nauthorized public keys configured on the SSH server for access. For such\n systems users are advised to:\n\n\n\n * generate a new secret/key/credential using gokey version 0.2.0 or above\n\n * provision the new secret/key/credential in addition to the existing credential on the system\n\n * verify that the access or required system operation is still possible with the new secret/key/credential\n\n * revoke authorization for the existing/old credential from the system\n\n\n\n\nCredit\nThis vulnerability was found by Théo Cusnir ( @mister_mime https://hackerone.com/mister_mime ) and responsibly disclosed through Cloudflare's bug bounty program."}],"id":"CVE-2025-13353","lastModified":"2026-06-17T08:33:58.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@cloudflare.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-13353","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-12-02T16:50:27.674442Z","version":"2.0.3"}}]},"published":"2025-12-02T11:15:47.437","references":[{"source":"cna@cloudflare.com","tags":["Vendor Advisory"],"url":"https://github.com/cloudflare/gokey/security/advisories/GHSA-69jw-4jj8-fcxm"}],"sourceIdentifier":"cna@cloudflare.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"}],"source":"cna@cloudflare.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"github.com/cloudflare/gokey","product":"gokey","repo":"https://github.com/cloudflare/gokey","vendor":"Cloudflare","versions":[{"lessThan":"0.2.0","status":"affected","version":"0.1.0","versionType":"semver"}]}],"source":"cna@cloudflare.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cloudflare:gokey:*:*:*:*:*:go:*:*","matchCriteriaId":"A8FEAB32-4588-4479-BCCA-5253FE85DB69","versionEndExcluding":"0.2.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In gokey versions <0.2.0,\n a flaw in the seed decryption logic resulted in passwords incorrectly \nbeing derived solely from the initial vector and the AES-GCM \nauthentication tag of the key seed.\n\n\nThis issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any passwords/secrets that were derived from the seed file (using the -s option). Even if the input seed file stays the same, version 0.2.0 gokey will generate different secrets.\n\n\nImpact\nThis vulnerability impacts generated keys/secrets using a seed file as an entropy input (using the -s option). Keys/secrets generated just from the master password (without the -s\n option) are not impacted. The confidentiality of the seed itself is \nalso not impacted (it is not required to regenerate the seed itself). \nSpecific impact includes:\n\n\n\n * keys/secrets generated from a seed file may have lower entropy: it \nwas expected that the whole seed would be used to generate keys (240 \nbytes of entropy input), where in vulnerable versions only 28 bytes was \nused\n\n * a malicious entity could have recovered all passwords, generated \nfrom a particular seed, having only the seed file in possession without \nthe knowledge of the seed master password\n\n\n\n\nPatches\nThe code logic bug has been fixed in gokey version 0.2.0\n and above. Due to the deterministic nature of gokey, fixed versions \nwill produce different passwords/secrets using seed files, as all seed \nentropy will be used now.\n\n\nSystem secret rotation guidance\nIt is advised for users to regenerate passwords/secrets using the patched version of gokey (0.2.0\n and above), and provision/rotate these secrets into respective systems \nin place of the old secret. A specific rotation procedure is \nsystem-dependent, but most common patterns are described below.\n\n\nSystems that do not require the old password/secret for rotation\nSuch systems usually have a \"Forgot password\" facility or a\n similar facility allowing users to rotate their password/secrets by \nsending a unique \"magic\" link to the user's email or phone. In such \ncases users are advised to use this facility and input the newly \ngenerated password secret, when prompted by the system.\n\n\nSystems that require the old password/secret for rotation\nSuch systems usually have a modal password rotation window\n usually in the user settings section requiring the user to input the \nold and the new password sometimes with a confirmation. To \ngenerate/recover the old password in such cases users are advised to:\n\n\n\n * temporarily download gokey version 0.1.3 https://github.com/cloudflare/gokey/releases/tag/v0.1.3 for their respective operating system to recover the old password\n\n * use gokey version 0.2.0 or above to generate the new password\n\n * populate the system provided password rotation form\n\n\n\n\nSystems that allow multiple credentials for the same account to be provisioned\nSuch systems usually require a secret or a cryptographic \nkey as a credential for access, but allow several credentials at the \nsame time. One example is SSH: a particular user may have several \nauthorized public keys configured on the SSH server for access. For such\n systems users are advised to:\n\n\n\n * generate a new secret/key/credential using gokey version 0.2.0 or above\n\n * provision the new secret/key/credential in addition to the existing credential on the system\n\n * verify that the access or required system operation is still possible with the new secret/key/credential\n\n * revoke authorization for the existing/old credential from the system\n\n\n\n\nCredit\nThis vulnerability was found by Théo Cusnir ( @mister_mime https://hackerone.com/mister_mime ) and responsibly disclosed through Cloudflare's bug bounty program."},{"lang":"es","value":"En versiones de gokey anteriores a la 0.2.0, un fallo en la lógica de descifrado de la semilla resultó en que las contraseñas se derivaran incorrectamente únicamente del vector inicial y la etiqueta de autenticación AES-GCM de la semilla de clave.\n\nEste problema ha sido solucionado en la versión 0.2.0 de gokey. Este es un cambio disruptivo. La solución ha invalidado cualquier contraseña o secreto que se haya derivado del archivo de semilla (usando la opción -s). Incluso si el archivo de semilla de entrada permanece igual, gokey versión 0.2.0 generará secretos diferentes.\n\nImpacto\nEsta vulnerabilidad impacta las claves y secretos generados usando un archivo de semilla como entrada de entropía (usando la opción -s). Las claves y secretos generados solo a partir de la contraseña maestra (sin la opción -s) no se ven impactados. La confidencialidad de la semilla en sí tampoco se ve impactada (no es necesario regenerar la semilla). El impacto específico incluye:\n\n* las claves y secretos generados a partir de un archivo de semilla pueden tener menor entropía: se esperaba que toda la semilla se utilizara para generar claves (240 bytes de entrada de entropía), mientras que en las versiones vulnerables solo se utilizaron 28 bytes\n* una entidad maliciosa podría haber recuperado todas las contraseñas generadas a partir de una semilla particular teniendo solo el archivo de semilla en su posesión sin conocer la contraseña maestra de la semilla\n\nParches\nEl error de lógica del código ha sido solucionado en la versión 0.2.0 de gokey y superiores. Debido a la naturaleza determinista de gokey, las versiones corregidas producirán contraseñas y secretos diferentes usando archivos de semilla, ya que ahora se utilizará toda la entropía de la semilla.\n\nGuía de rotación de secretos del sistema\nSe aconseja a los usuarios regenerar contraseñas y secretos usando la versión parcheada de gokey (0.2.0 y superiores), y aprovisionar o rotar estos secretos en los sistemas respectivos en lugar del secreto antiguo. Un procedimiento de rotación específico depende del sistema, pero los patrones más comunes se describen a continuación.\n\nSistemas que no requieren la contraseña o secreto antiguo para la rotación\nDichos sistemas suelen tener una función de recuperación de contraseña o similar que permite a los usuarios rotar sus contraseñas o secretos enviando un enlace único al correo electrónico o teléfono del usuario. En tales casos, se aconseja a los usuarios utilizar esta función e introducir el secreto de contraseña recién generado cuando el sistema lo solicite.\n\nSistemas que requieren la contraseña o secreto antiguo para la rotación\nDichos sistemas suelen tener una ventana modal de rotación de contraseñas en la sección de configuración del usuario que requiere introducir la contraseña antigua y la nueva. Para generar o recuperar la contraseña antigua en tales casos, se aconseja a los usuarios:\n\n* descargar temporalmente gokey versión 0.1.3 (https://github.com/cloudflare/gokey/releases/tag/v0.1.3) para su sistema operativo respectivo para recuperar la contraseña antigua\n* usar gokey versión 0.2.0 o superior para generar la nueva contraseña\n* rellenar el formulario de rotación de contraseñas proporcionado por el sistema\n\nSistemas que permiten aprovisionar múltiples credenciales para la misma cuenta\nDichos sistemas suelen requerir un secreto o una clave criptográfica como credencial para el acceso, pero permiten varias credenciales al mismo tiempo. Un ejemplo es SSH: un usuario particular puede tener varias claves públicas autorizadas configuradas en el servidor SSH para el acceso. Para tales sistemas, se aconseja a los usuarios:\n\n* generar un nuevo secreto, clave o credencial usando gokey versión 0.2.0 o superior\n* aprovisionar el nuevo secreto, clave o credencial además de la credencial existente en el sistema\n* verificar que el acceso o la operación del sistema requerida sigue siendo posible con el nuevo secreto, clave o credencial\n* revocar la autorización para la credencial existente o antigua del sistema\n\nCréditos\nEsta --TRUNCADO--"}],"id":"CVE-2025-13353","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@cloudflare.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-13353","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-12-02T16:50:27.674442Z","version":"2.0.3"}}]},"published":"2025-12-02T11:15:47.437","references":[{"source":"cna@cloudflare.com","tags":["Vendor Advisory"],"url":"https://github.com/cloudflare/gokey/security/advisories/GHSA-69jw-4jj8-fcxm"}],"sourceIdentifier":"cna@cloudflare.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"}],"source":"cna@cloudflare.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-15711.json b/data/2025/CVE-2025-15711.json index 039a8fdb82..e610f1d8a7 100644 --- a/data/2025/CVE-2025-15711.json +++ b/data/2025/CVE-2025-15711.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups)."},{"lang":"es","value":"Aplíquese el plugin de WordPress Live Composer versiones anteriores a 2.1.24 no sanitiza ni escape algunas de sus configuraciones de módulo antes de salir en un atributo href, lo que podría permitir a usuarios con privilegios altos, como administradores, realizar ataques de Cross-Site Scripting almacenados incluso cuando la capacidad unfiltrada_html está desactivada (por ejemplo, en configuraciones de multisitio)."}],"id":"CVE-2025-15711","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15711","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:28:36.250909Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:08.427","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/3c296d09-122f-420e-9ab1-81ffdfff88c2/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups)."},{"lang":"es","value":"El plugin Live Composer para WordPress en versiones anteriores a la 2.1.24 no sanea ni escapa adecuadamente algunos de los ajustes de sus módulos antes de mostrarlos en un atributo href, lo que podría permitir a usuarios con privilegios elevados, como los administradores, realizar ataques de Cross-Site Scripting (XSS) almacenado incluso cuando la capacidad unfiltered_html está deshabilitada (por ejemplo, en configuraciones multisitio)."}],"id":"CVE-2025-15711","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15711","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:28:36.250909Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:08.427","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/3c296d09-122f-420e-9ab1-81ffdfff88c2/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-15712.json b/data/2025/CVE-2025-15712.json index d9c397902d..e57b4926f3 100644 --- a/data/2025/CVE-2025-15712.json +++ b/data/2025/CVE-2025-15712.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pages, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups)."},{"lang":"es","value":"El plugin de WordPress Live Composer antes de la versión 2.1.24 no sanitiza ni escape algunos de sus ajustes de personal para su salida en páginas, lo que podría permitir a usuarios de alto privilegio como administradores realizar ataques de Cross-Site Scripting almacenados incluso cuando la capacidad de unfiltered_html está deshabilitada (por ejemplo, en entornos de multisite).\n\nNota: He mantenido el contexto técnico y la precisión del original."}],"id":"CVE-2025-15712","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15712","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:28:23.457888Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.033","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/00d2c75d-7e8f-4f6c-8b72-c66b1bb6cc59/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pages, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups)."},{"lang":"es","value":"El plugin Live Composer para WordPress en versiones anteriores a la 2.1.24 no sanea ni escapa adecuadamente algunos de los ajustes de miembros del personal antes de mostrarlos en las páginas, lo que podría permitir a usuarios con privilegios elevados, como los administradores, realizar ataques de Cross-Site Scripting (XSS) almacenado incluso cuando la capacidad unfiltered_html está deshabilitada (por ejemplo, en configuraciones multisitio)."}],"id":"CVE-2025-15712","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15712","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:28:23.457888Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.033","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/00d2c75d-7e8f-4f6c-8b72-c66b1bb6cc59/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-15713.json b/data/2025/CVE-2025-15713.json index d918665f97..1a9e98c00d 100644 --- a/data/2025/CVE-2025-15713.json +++ b/data/2025/CVE-2025-15713.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes when the affected page is viewed by any visitor; this has impact even on administrators where the unfiltered_html capability is disallowed, e.g. in multisite setups."},{"lang":"es","value":"La extensión Live Composer de WordPress, antes de la versión 2.1.24, no sanitiza ni evita la escapada de algunos de sus configuraciones del módulo de edición de página antes de mostrarlas, lo que permite a los usuarios con acceso al editor (de forma predeterminada, el Administrador) inyectar código JavaScript arbitrario que se ejecuta cuando la página afectada se ve por cualquier visitante; este impacto aún afecta incluso a los administradores donde la capacidad de unificación de HTML no está deshabilitada, por ejemplo, en configuraciones de multisite.\n\nNota: He utilizado la palabra “extensión” para traducir “plugin”, como es común en español. Si prefieres utilizar “modo de WordPress”, puedo hacer la traducción."}],"id":"CVE-2025-15713","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15713","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:28:04.856633Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.167","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/eb5d2c5b-0035-4c84-876a-b4268e27e3cc/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes when the affected page is viewed by any visitor; this has impact even on administrators where the unfiltered_html capability is disallowed, e.g. in multisite setups."},{"lang":"es","value":"El plugin Live Composer para WordPress en versiones anteriores a la 2.1.24 no sanea ni escapa adecuadamente algunas configuraciones de su módulo constructor de páginas antes de mostrarlas, lo que permite a los usuarios con acceso al constructor (el Administrador por defecto) inyectar código JavaScript arbitrario que se ejecuta cuando cualquier visitante visualiza la página afectada; esto tiene impacto incluso sobre administradores cuando la capacidad unfiltered_html está deshabilitada, por ejemplo, en configuraciones multisitio."}],"id":"CVE-2025-15713","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15713","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:28:04.856633Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.167","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/eb5d2c5b-0035-4c84-876a-b4268e27e3cc/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-15714.json b/data/2025/CVE-2025-15714.json index 206a0f5e43..67a630f86b 100644 --- a/data/2025/CVE-2025-15714.json +++ b/data/2025/CVE-2025-15714.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on the front end, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups)."},{"lang":"es","value":"La versión anterior de Live Composer WordPress (antes de 2.1.24) no sanitiza ni evita la escape de algunos ajustes de su módulo Botón antes de su salida al frente, lo cual podría permitir a los usuarios con privilegios altos, como los administradores, realizar ataques de Cross-Site Scripting almacenados incluso cuando se deshabilita la capacidad de mostrar HTML no filtrado (por ejemplo, en configuraciones de multisitio)."}],"id":"CVE-2025-15714","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15714","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:53.148629Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.293","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/03a1c844-9a9f-4702-ba6c-3ada3e779014/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Composer","vendor":"Unknown","versions":[{"lessThan":"2.1.24","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on the front end, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups)."},{"lang":"es","value":"El plugin Live Composer para WordPress en versiones anteriores a la 2.1.24 no sanea ni escapa adecuadamente algunos ajustes de su módulo Button antes de mostrarlos en el front-end, lo que podría permitir a usuarios con privilegios elevados, como los administradores, realizar ataques de Cross-Site Scripting (XSS) almacenado incluso cuando la capacidad unfiltered_html está deshabilitada (por ejemplo, en configuraciones multisitio)."}],"id":"CVE-2025-15714","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-15714","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T11:27:53.148629Z","version":"2.0.3"}}]},"published":"2026-11-11T06:17:10.293","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/03a1c844-9a9f-4702-ba6c-3ada3e779014/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-29940.json b/data/2025/CVE-2025-29940.json index a074c86e07..433c695594 100644 --- a/data/2025/CVE-2025-29940.json +++ b/data/2025/CVE-2025-29940.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unverified ownership in Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker with access to a malicious hypervisor to overwrite guest memory if segmented Reverse Map Table (RMP) is enabled potentially resulting in loss of guest data integrity."}],"id":"CVE-2025-29940","lastModified":"2026-11-13T00:20:04.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-29940","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:44:14.087317Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:45.890","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-283"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unverified ownership in Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker with access to a malicious hypervisor to overwrite guest memory if segmented Reverse Map Table (RMP) is enabled potentially resulting in loss of guest data integrity."},{"lang":"es","value":"Una propiedad no verificada en el firmware de Secure Encrypted Virtualization (SEV) podría permitir a un atacante con privilegios y acceso a un hipervisor malicioso sobrescribir la memoria del huésped si la Reverse Map Table (RMP) segmentada está habilitada, lo que potencialmente resultaría en una pérdida de integridad de los datos del huésped."}],"id":"CVE-2025-29940","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-29940","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:44:14.087317Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:45.890","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-283"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-29941.json b/data/2025/CVE-2025-29941.json index 6bf1fcf2a7..342cc65b6b 100644 --- a/data/2025/CVE-2025-29941.json +++ b/data/2025/CVE-2025-29941.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect usage of seeds in pseudo-random number generator in the Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor or migration agent to import a forged guest context potentially resulting in loss of confidentiality for derived guest keys."}],"id":"CVE-2025-29941","lastModified":"2026-11-13T00:20:04.280","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-29941","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:50:34.620832Z","version":"2.0.3"}}]},"published":"2026-11-10T23:17:18.863","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-335"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect usage of seeds in pseudo-random number generator in the Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor or migration agent to import a forged guest context potentially resulting in loss of confidentiality for derived guest keys."},{"lang":"es","value":"El uso incorrecto de semillas en el generador de números pseudoaleatorios en el firmware de Secure Encrypted Virtualization (SEV) podría permitir a un hipervisor malicioso o a un agente de migración importar un contexto de huésped falsificado, lo que potencialmente resultaría en una pérdida de confidencialidad para las claves derivadas del huésped."}],"id":"CVE-2025-29941","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-29941","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:50:34.620832Z","version":"2.0.3"}}]},"published":"2026-11-10T23:17:18.863","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-335"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-41725.json b/data/2025/CVE-2025-41725.json index 14bdca9af9..a256612713 100644 --- a/data/2025/CVE-2025-41725.json +++ b/data/2025/CVE-2025-41725.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Flip 4","vendor":"JBL","versions":[{"lessThan":"4.1.0","status":"affected","version":"0.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker."}],"id":"CVE-2025-41725","lastModified":"2026-11-13T21:17:35.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-41725","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T21:01:50.713795Z","version":"2.0.3"}}]},"published":"2026-11-13T13:17:38.957","references":[{"source":"info@cert.vde.com","url":"https://certvde.com/en/advisories/VDE-2025-090/"},{"source":"info@cert.vde.com","url":"https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2026/hbsa-2025-0003.json"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-923"}],"source":"info@cert.vde.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Flip 4","vendor":"JBL","versions":[{"lessThan":"4.1.0","status":"affected","version":"0.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker."},{"lang":"es","value":"Los dispositivos afectados que ejecutan versiones de firmware anteriores a la 4.1.0 pueden bloquearse y dejar de estar disponibles al recibir mensajes Bluetooth malformados específicos de un atacante no autenticado."}],"id":"CVE-2025-41725","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"info@cert.vde.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-41725","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T21:01:50.713795Z","version":"2.0.3"}}]},"published":"2026-11-13T13:17:38.957","references":[{"source":"info@cert.vde.com","url":"https://certvde.com/en/advisories/VDE-2025-090/"},{"source":"info@cert.vde.com","url":"https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2026/hbsa-2025-0003.json"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-923"}],"source":"info@cert.vde.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-48504.json b/data/2025/CVE-2025-48504.json index e8724f01bd..15bd04cb20 100644 --- a/data/2025/CVE-2025-48504.json +++ b/data/2025/CVE-2025-48504.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Operation on a resource after expiration or release in the Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to manipulate metadata pages potentially resulting in the loss of confidentiality and integrity of guest memory."}],"id":"CVE-2025-48504","lastModified":"2026-11-13T00:20:04.427","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-48504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:50:03.090117Z","version":"2.0.3"}}]},"published":"2026-11-10T23:17:19.017","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1005"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Operation on a resource after expiration or release in the Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to manipulate metadata pages potentially resulting in the loss of confidentiality and integrity of guest memory."},{"lang":"es","value":"Una operación sobre un recurso tras su expiración o liberación en el firmware de Secure Encrypted Virtualization (SEV) podría permitir a un hipervisor malicioso manipular páginas de metadatos, lo que potencialmente resultaría en la pérdida de confidencialidad e integridad de la memoria del huésped."}],"id":"CVE-2025-48504","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-48504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:50:03.090117Z","version":"2.0.3"}}]},"published":"2026-11-10T23:17:19.017","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-52535.json b/data/2025/CVE-2025-52535.json index 53f0c68236..74ebe244d4 100644 --- a/data/2025/CVE-2025-52535.json +++ b/data/2025/CVE-2025-52535.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper resource reuse in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor access to write to the Reverse Map Table (RMP) protected memory, potentially resulting in loss of guest memory integrity."}],"id":"CVE-2025-52535","lastModified":"2026-11-13T00:20:04.570","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-52535","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:42:59.286501Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.027","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper resource reuse in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor access to write to the Reverse Map Table (RMP) protected memory, potentially resulting in loss of guest memory integrity."},{"lang":"es","value":"Una reutilización inadecuada de recursos en el firmware de AMD Secure Encrypted Virtualization (SEV) podría permitir a un atacante con acceso al hipervisor escribir en la memoria protegida por la Reverse Map Table (RMP), lo que potencialmente resultaría en una pérdida de integridad de la memoria del huésped."}],"id":"CVE-2025-52535","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-52535","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:42:59.286501Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.027","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-52537.json b/data/2025/CVE-2025-52537.json index 03de9ccb19..2f1fb15afb 100644 --- a/data/2025/CVE-2025-52537.json +++ b/data/2025/CVE-2025-52537.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control within the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to tamper with memory, potentially resulting in loss of guest memory integrity."}],"id":"CVE-2025-52537","lastModified":"2026-11-13T00:20:04.700","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-52537","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:43:44.134862Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.163","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control within the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to tamper with memory, potentially resulting in loss of guest memory integrity."},{"lang":"es","value":"Un control de acceso inadecuado dentro del firmware de AMD Secure Encrypted Virtualization (SEV) podría permitir a un atacante con privilegios administrativos manipular la memoria, lo que potencialmente resultaría en una pérdida de integridad de la memoria del huésped."}],"id":"CVE-2025-52537","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-52537","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:43:44.134862Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.163","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54501.json b/data/2025/CVE-2025-54501.json index 6cec4ce757..ab7e7c08ed 100644 --- a/data/2025/CVE-2025-54501.json +++ b/data/2025/CVE-2025-54501.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control on an internal debug interface could allow a high privileged attacker to bypass memory access controls potentially resulting in a loss of SEV-SNP guest memory integrity."},{"lang":"es","value":"Acceso no controlado inadecuado a una interfaz de depuración interna podría permitir a un atacante altamente privilegiado superar los controles de acceso a la memoria potencialmente resultando en una pérdida de integridad de la memoria del huésped SEV-SNP.”\n\nNota: Se ha mantenido la estructura y el significado original del texto, pero se ha adaptado el lenguaje y las referencias para adaptarse al español.\n\nEn el contexto de la seguridad de la plataforma, la vulnerabilidad representa un riesgo potencial para la integridad de la memoria del huésped SEV-SNP. Por lo tanto, es esencial realizar un análisis exhaustivo de esta vulnerabilidad para identificar y corregir cualquier error de acceso.\n\nEn este contexto, se considera importante realizar un análisis de la interfaz de depuración interna para identificar cualquier posible error de acceso que pueda permitir a un atacante altamente privilegiado superar los controles de acceso a la memoria. Al realizar este análisis, se pueden tomar medidas correctivas para prevenir cualquier pérdida potencial de integridad de la memoria del huésped SEV-SNP."}],"id":"CVE-2025-54501","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54501","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:17:42.748134Z","version":"2.0.3"}}]},"published":"2026-11-12T19:16:45.017","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3054.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1191"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control on an internal debug interface could allow a high privileged attacker to bypass memory access controls potentially resulting in a loss of SEV-SNP guest memory integrity."},{"lang":"es","value":"Un control de acceso inadecuado en una interfaz de depuración interna podría permitir a un atacante con privilegios elevados eludir los controles de acceso a la memoria, lo que potencialmente resultaría en una pérdida de integridad de la memoria del huésped en SEV-SNP."}],"id":"CVE-2025-54501","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54501","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:17:42.748134Z","version":"2.0.3"}}]},"published":"2026-11-12T19:16:45.017","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3054.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1191"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54503.json b/data/2025/CVE-2025-54503.json index d8777595e2..d1fec6ffc7 100644 --- a/data/2025/CVE-2025-54503.json +++ b/data/2025/CVE-2025-54503.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of overlap between protected memory ranges in the Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker to cause misconfigurations in the RMP potentially resulting in loss of integrity."},{"lang":"es","value":"El manejo adecuado de la superposición entre rango de memoria protegida en el firmware de Virtualización Cifrada Segura (SEV) podría permitir a un atacante privilegiado causar malas configuraciones en el RMP potencialmente resultando en pérdida de integridad.\n\nNota: Al hacer el traducción, se ha intentado mantener la exactitud y la claridad del contexto técnico original."}],"id":"CVE-2025-54503","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54503","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:38:10.484039Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.317","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1260"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of overlap between protected memory ranges in the Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker to cause misconfigurations in the RMP potentially resulting in loss of integrity."},{"lang":"es","value":"Un manejo inadecuado del solapamiento entre rangos de memoria protegida en el firmware de Secure Encrypted Virtualization (SEV) podría permitir a un atacante con privilegios provocar configuraciones erróneas en la Reverse Map Table (RMP), lo que potencialmente resultaría en una pérdida de integridad."}],"id":"CVE-2025-54503","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54503","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:38:10.484039Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.317","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1260"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54504.json b/data/2025/CVE-2025-54504.json index f83554908d..b2286090bf 100644 --- a/data/2025/CVE-2025-54504.json +++ b/data/2025/CVE-2025-54504.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges attacker to write to a trusted region used by AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES), potentially resulting in loss of integrity."},{"lang":"es","value":"Insuficiente granularidad en el control de acceso en el firmware de AMD Secure Encrypted Virtualización (SEV) podría permitir a un atacante con privilegios administrativos escribir en una región confiable utilizada por AMD Secure Encrypted Virtualization - Estado Encrypted (SEV-ES), lo que potencialmente podría llevar a una pérdida de integridad.\n\nNota: He intentado mantener la misma estructura y la misma precisión en la traducción."}],"id":"CVE-2025-54504","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:39:44.566667Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.470","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges attacker to write to a trusted region used by AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES), potentially resulting in loss of integrity."},{"lang":"es","value":"Una granularidad insuficiente del control de acceso en el firmware de AMD Secure Encrypted Virtualization (SEV) podría permitir a un atacante con privilegios administrativos escribir en una región de confianza utilizada por AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES), lo que potencialmente resultaría en una pérdida de integridad."}],"id":"CVE-2025-54504","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:39:44.566667Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.470","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54506.json b/data/2025/CVE-2025-54506.json index 9fd4a8dac5..f3b8aa75f4 100644 --- a/data/2025/CVE-2025-54506.json +++ b/data/2025/CVE-2025-54506.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to bypass security checks on scatter lists, potentially resulting in loss of guest integrity."},{"lang":"es","value":"Aquí está la traducción:\n\nUna condición de carrera TOCTOU (tiempo de verificación y tiempo de uso) en el firmware de SEV (Seguridad Encrypted Virtualización) AMD Secure (SEV) podría permitir a un atacante con privilegios administrativos evitar las comprobaciones de seguridad en listas dispersas, lo que podría provocar la pérdida de integridad del huésped.\n\nNota: He utilizado un lenguaje técnico adecuado para mantener la precisión del original, pero también he intentado simplificar la frase para hacerla más fácil de entender para un público general."}],"id":"CVE-2025-54506","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54506","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:37:22.980351Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.640","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to bypass security checks on scatter lists, potentially resulting in loss of guest integrity."},{"lang":"es","value":"Una condición de carrera de tipo Time-of-Check to Time-of-Use (TOCTOU) en el firmware de AMD Secure Encrypted Virtualization (SEV) podría permitir a un atacante con privilegios administrativos eludir las comprobaciones de seguridad en las listas de dispersión (scatter lists), lo que potencialmente resultaría en una pérdida de integridad del huésped."}],"id":"CVE-2025-54506","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54506","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:37:22.980351Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.640","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54507.json b/data/2025/CVE-2025-54507.json index aacf287ced..f8934e50f6 100644 --- a/data/2025/CVE-2025-54507.json +++ b/data/2025/CVE-2025-54507.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker with administrative privileges to create multiple RMP entries for the same guest physical address, potentially resulting in loss of guest integrity."},{"lang":"es","value":"A la hora de validar la consistencia de entrada en el firmware AMD SEV (Secured Encrypted Virtualization), hay un riesgo de que un atacante con privilegios administrativos pueda crear múltiples RMP (Resource Management Protocol) entries para la misma dirección física del huésped, lo que podría provocar una pérdida de integridad del huésped.\n\nNota: He mantenido el contexto técnico y la precisión en el traducción."}],"id":"CVE-2025-54507","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:16:17.805215Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:14.030","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3058.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1288"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker with administrative privileges to create multiple RMP entries for the same guest physical address, potentially resulting in loss of guest integrity."},{"lang":"es","value":"Una validación inadecuada de la consistencia en los datos de entrada en el firmware de AMD Secure Encrypted Virtualization (SEV) podría permitir a un atacante con privilegios administrativos crear múltiples entradas en la Reverse Map Table (RMP) para la misma dirección física del huésped, lo que potencialmente resultaría en una pérdida de integridad del huésped."}],"id":"CVE-2025-54507","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:16:17.805215Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:14.030","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3058.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1288"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54508.json b/data/2025/CVE-2025-54508.json index e555693be7..3b8672cf37 100644 --- a/data/2025/CVE-2025-54508.json +++ b/data/2025/CVE-2025-54508.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of Reverse Map Table (RMP) entries in the Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker to trigger concurrent modifications to RMP entries without proper synchronization potentially resulting in loss of data integrity."},{"lang":"es","value":"Aquí está la traducción:\n\nInvalidez inadecuada de las entradas de la Tabla de Mapeo Inverso (RMP) en el firmware de virtualización segura y cifrada (SEV)\n\nLa falta de validación adecuada de las entradas de la tabla de mapeo inverso (RMP) en el firmware de virtualización segura y cifrada (SEV) podría permitir a un atacante con privilegios desencadenar modificaciones concurrentes de las entradas de RMP sin sincronización adecuada, lo que potencialmente podría resultar en una pérdida de integridad de los datos.\n\nNota: He mantenido el contexto técnico y la precisión del texto original, manteniendo la estructura y el significado de la frase."}],"id":"CVE-2025-54508","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54508","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:38:51.520840Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.807","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-179"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of Reverse Map Table (RMP) entries in the Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker to trigger concurrent modifications to RMP entries without proper synchronization potentially resulting in loss of data integrity."},{"lang":"es","value":"Una validación inadecuada de las entradas de la Reverse Map Table (RMP) en el firmware de Secure Encrypted Virtualization (SEV) podría permitir a un atacante con privilegios desencadenar modificaciones concurrentes en las entradas de la RMP sin la sincronización adecuada, lo que potencialmente resultaría en una pérdida de integridad de los datos."}],"id":"CVE-2025-54508","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-54508","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:38:51.520840Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.807","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-179"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-59847.json b/data/2025/CVE-2025-59847.json index 0d82662159..7268c72ddd 100644 --- a/data/2025/CVE-2025-59847.json +++ b/data/2025/CVE-2025-59847.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HCL Domino Leap","vendor":"HCL Software","versions":[{"status":"affected","version":"1.1.66 - 1.1.9"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session"},{"lang":"es","value":"Aquí está la traducción:\n\n“Domino Leap de HCL es vulnerable a XSS almacenado debido a títulos de aplicación maliciosos en los diálogos de la página de gestión, lo que permite al atacante tomar el control de la sesión de un usuario”.\n\nNota: El término “XSS” se traduce como “XSS almacenado”, ya que se refiere a un tipo específico de vulnerabilidad de seguridad conocida como “Stored Cross-Site Scripting”."}],"id":"CVE-2025-59847","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"psirt@hcl.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.427","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134535"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@hcl.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HCL Domino Leap","vendor":"HCL Software","versions":[{"status":"affected","version":"1.1.66 - 1.1.9"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session"},{"lang":"es","value":"HCL Domino Leap es vulnerable a Cross-Site Scripting (XSS) almacenado a través de títulos de aplicación maliciosos en los cuadros de diálogo de la página Manage, lo que permite a un atacante tomar el control de la sesión de un usuario."}],"id":"CVE-2025-59847","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"psirt@hcl.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.427","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134535"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@hcl.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-59848.json b/data/2025/CVE-2025-59848.json index 9a7bdd7404..23c75ea759 100644 --- a/data/2025/CVE-2025-59848.json +++ b/data/2025/CVE-2025-59848.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HCL Leap","vendor":"HCL Software","versions":[{"status":"affected","version":"9.3.88 - 9.2.10"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session"},{"lang":"es","value":"La vulnerabilidad HCL Leap se debe a un Stored XSS (Cross-Site Scripting) causado por títulos maliciosos de aplicaciones en las diálogos de la página de administración “Manage”, lo que permite al atacante tomar el control de la sesión de un usuario."}],"id":"CVE-2025-59848","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"psirt@hcl.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.603","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134534"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@hcl.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HCL Leap","vendor":"HCL Software","versions":[{"status":"affected","version":"9.3.88 - 9.2.10"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session"},{"lang":"es","value":"HCL Leap es vulnerable a Cross-Site Scripting (XSS) almacenado a través de títulos de aplicación maliciosos en los cuadros de diálogo de la página Manage, lo que permite a un atacante tomar el control de la sesión de un usuario."}],"id":"CVE-2025-59848","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"psirt@hcl.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.603","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134534"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@hcl.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-61625.json b/data/2025/CVE-2025-61625.json index 7a8ca647cf..7e66bb6d7d 100644 --- a/data/2025/CVE-2025-61625.json +++ b/data/2025/CVE-2025-61625.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.10","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.11, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10 may allow an authenticated attacker whose profile only has read permission to write and delete files from the underlying filesystem via crafted HTTP or HTTPs requests."}],"id":"CVE-2025-61625","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-61625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.203","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-190"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.10","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.11, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.11, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10 may allow an authenticated attacker whose profile only has read permission to write and delete files from the underlying filesystem via crafted HTTP or HTTPs requests."},{"lang":"es","value":"Una vulnerabilidad de limitación inadecuada de una ruta a un directorio restringido (salto de directorio) en Fortinet FortiAnalyzer 7.6.0 a 7.6.4, FortiAnalyzer 7.4.0 a 7.4.7, FortiAnalyzer 7.2.0 a 7.2.11, FortiManager 7.6.0 a 7.6.4, FortiManager 7.4.0 a 7.4.7, FortiManager 7.2.0 a 7.2.11, FortiManager Cloud 7.6.0 a 7.6.4, FortiManager Cloud 7.4.1 a 7.4.7 y FortiManager Cloud 7.2.1 a 7.2.10 podría permitir a un atacante autenticado cuyo perfil solo tiene permisos de lectura escribir y eliminar archivos del sistema de archivos subyacente mediante solicitudes HTTP o HTTPS manipuladas."}],"id":"CVE-2025-61625","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-61625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.203","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-190"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-62620.json b/data/2025/CVE-2025-62620.json index c50e3d35c3..900dfdc807 100644 --- a/data/2025/CVE-2025-62620.json +++ b/data/2025/CVE-2025-62620.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer queue status page, potentially resulting in loss of guest memory integrity."}],"id":"CVE-2025-62620","lastModified":"2026-11-13T00:20:05.383","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-62620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:41:28.925596Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.990","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1289"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"MilanPI-SP3_1.0.0.K"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"GenoaPI_1.0.0.J"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbMilanPI-SP3 1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedGenoaPI_1.0.0.E"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer queue status page, potentially resulting in loss of guest memory integrity."},{"lang":"es","value":"Una validación inadecuada de equivalencia insegura en los datos de entrada podría permitir a un atacante con privilegios elevados reclamar la página de estado de la cola de búfer en anillo (ring buffer), lo que potencialmente resultaría en una pérdida de integridad de la memoria del huésped."}],"id":"CVE-2025-62620","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-62620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:41:28.925596Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:46.990","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1289"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-62621.json b/data/2025/CVE-2025-62621.json index 37873f9124..80d5d056aa 100644 --- a/data/2025/CVE-2025-62621.json +++ b/data/2025/CVE-2025-62621.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Expected behavior violation in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Reverse Map Table (RMP) protections, potentially resulting in a loss of Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest memory integrity."},{"lang":"es","value":"Violación de comportamiento esperado en firmware de SEV de AMD con cifrado seguro de virtualización podría permitir a un hipervisor malicioso evitar las protecciones de la Tabla de Mapeo Inverso (RMP), lo que podría provocar una pérdida de integridad de la memoria del huésped de SEV-SNP cifrada seguro-nested.”\n\nNota: He mantenido la estructura y el sentido original del texto, adaptándolo al contexto de la traducción al español."}],"id":"CVE-2025-62621","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-62621","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:40:18.597035Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:47.160","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-440"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Expected behavior violation in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Reverse Map Table (RMP) protections, potentially resulting in a loss of Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest memory integrity."},{"lang":"es","value":"Una violación del comportamiento esperado en el firmware de AMD Secure Encrypted Virtualization (SEV) podría permitir a un hipervisor malicioso eludir las protecciones de la Reverse Map Table (RMP), lo que potencialmente resultaría en una pérdida de integridad de la memoria del huésped en Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP)."}],"id":"CVE-2025-62621","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-62621","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T23:40:18.597035Z","version":"2.0.3"}}]},"published":"2026-11-10T22:17:47.160","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-440"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-71459.json b/data/2025/CVE-2025-71459.json index 7d5ead3d14..107277d2be 100644 --- a/data/2025/CVE-2025-71459.json +++ b/data/2025/CVE-2025-71459.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/zipline","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"4.3.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service."},{"lang":"es","value":"Recorrido por 4.3.2 incluye una vulnerabilidad de salto de ruta que permite que los submisores autenticados escriban archivos fuera del directorio de carga de submisión suministrando secuencias de traversión en el encabezado de nombre de archivo x-zipline-filename. Los atacantes utilizando el origen de datos local pueden crear o sobreescribir archivos que están escritos por el proceso de Zipline, corrompiendo los datos de la aplicación o interrumpiendo el servicio.”\n\nNota: He mantenido el contexto técnico y la precisión de la descripción original, mientras se adapta a la gramática y el estilo de la idioma español."}],"id":"CVE-2025-71459","lastModified":"2026-11-13T21:17:35.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71459","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T20:34:21.054650Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:23.780","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-4jm6-mgwv-fq63"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-4.3.2-path-traversal-via-x-zipline-filename-header"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/zipline","product":"zipline","vendor":"diced","versions":[{"lessThanOrEqual":"4.3.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service."},{"lang":"es","value":"Zipline hasta la versión 4.3.2 contiene una vulnerabilidad de salto de directorio (path traversal) que permite a usuarios autenticados con permisos de subida escribir archivos fuera del directorio de cargas suministrando secuencias de salto de ruta en la cabecera x-zipline-filename. Los atacantes que utilizan el origen de datos local pueden crear o sobrescribir archivos con permisos de escritura para el proceso de Zipline, corrompiendo los datos de la aplicación o interrumpiendo el servicio."}],"id":"CVE-2025-71459","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71459","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T20:34:21.054650Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:23.780","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-4jm6-mgwv-fq63"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-through-4.3.2-path-traversal-via-x-zipline-filename-header"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-71460.json b/data/2025/CVE-2025-71460.json index e821f6cf90..162d82fce1 100644 --- a/data/2025/CVE-2025-71460.json +++ b/data/2025/CVE-2025-71460.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.2.1","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"4.2.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user."},{"lang":"es","value":"Aquí está la traducción del texto:\n\n“Zipline antes de 4.2.1 contiene una vulnerabilidad de falta de autorización en el endpoint de transacción de archivos de usuario /api/user/files/ que permite a los usuarios autenticados modificar los archivos de otros usuarios debido a la ausencia de verificación de propiedad. Los atacantes que conocen el ID de un archivo objetivo pueden enviar solicitudes de transacción para editar o eliminar archivos de cualquier usuario”.\n\nNota: he mantenido el contexto técnico original y utilizado un lenguaje claro y conciso en el español."}],"id":"CVE-2025-71460","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:23.940","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-26wv-mhc3-5xfq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.2.1-missing-ownership-check-via-api-user-files-transaction"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.2.1","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"4.2.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user."},{"lang":"es","value":"Zipline en versiones anteriores a la 4.2.1 contiene una vulnerabilidad de falta de autorización en el endpoint /api/user/files/transaction que permite a usuarios autenticados modificar los archivos de otros usuarios debido a la ausencia de comprobaciones de propiedad. Los atacantes que conocen el identificador de un archivo objetivo pueden enviar solicitudes de transacción para editar o eliminar archivos pertenecientes a cualquier usuario."}],"id":"CVE-2025-71460","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:23.940","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-26wv-mhc3-5xfq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.2.1-missing-ownership-check-via-api-user-files-transaction"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2025/CVE-2025-71461.json b/data/2025/CVE-2025-71461.json index a31d253f1e..5aaf5d55c7 100644 --- a/data/2025/CVE-2025-71461.json +++ b/data/2025/CVE-2025-71461.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced"}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads."},{"lang":"es","value":"La vulnerabilidad Zipline antes de la versión 4.0.2 contiene una vulnerabilidad de nombre de archivo predecible que permite a los atacantes inferir los nombres de archivo de subida de otros usuarios recuperando el estado del generador Math.random. Los atacantes con cinco nombres de archivo consecutivos de estilo gfycat pueden reconstruir el estado aleatorio para predecir nombres de archivo anteriores y futuros hasta que el inicio se reinicie, exponiendo cargas de archivo privadas."}],"id":"CVE-2025-71461","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:24.100","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-6rg9-q9ww-w2rw"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.0.2-predictable-filenames-via-math-random-state-recovery"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-338"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced"}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads."},{"lang":"es","value":"Zipline en versiones anteriores a la 4.0.2 contiene una vulnerabilidad de nombres de archivo predecibles que permite a los atacantes inferir los nombres de los archivos subidos por otros usuarios recuperando el estado del generador Math.random. Los atacantes que obtienen cinco nombres de archivo consecutivos de estilo gfycat pueden reconstruir el estado aleatorio para predecir nombres de archivo anteriores y futuros hasta que la instancia se reinicie, exponiendo archivos privados subidos."}],"id":"CVE-2025-71461","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:24.100","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-6rg9-q9ww-w2rw"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.0.2-predictable-filenames-via-math-random-state-recovery"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-338"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2025/CVE-2025-71462.json b/data/2025/CVE-2025-71462.json index 7b60c2d190..b4754ca93d 100644 --- a/data/2025/CVE-2025-71462.json +++ b/data/2025/CVE-2025-71462.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"3.7.12","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.7.12","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login."},{"lang":"es","value":"Zipline antes de 3.7.12 contiene una vulnerabilidad de script de sitio cruzado en la página de inicio de sesión que permite a los atacantes ejecutar código JavaScript suministrando un parámetro de URL no validado. Los atacantes pueden crear un enlace de inicio de sesión con una URI de javascript_protocol: en el parámetro de URL que ejecuta en el navegador del víctima después del inicio de sesión."}],"id":"CVE-2025-71462","lastModified":"2026-11-13T20:10:00.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71462","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:54.975130Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:24.250","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-m288-p6wr-m6gv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-3.7.12-xss-via-url-parameter-on-login-page"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"zipline","vendor":"diced","versions":[{"lessThan":"3.7.12","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.7.12","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login."},{"lang":"es","value":"Zipline en versiones anteriores a la 3.7.12 contiene una vulnerabilidad de Cross-Site Scripting (XSS) en la página de inicio de sesión que permite a los atacantes ejecutar código JavaScript suministrando un parámetro url no validado. Los atacantes pueden diseñar un enlace de inicio de sesión con un URI javascript_protocol: en el parámetro url que se ejecuta en el navegador de la víctima tras iniciar sesión."}],"id":"CVE-2025-71462","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71462","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:54.975130Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:24.250","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-m288-p6wr-m6gv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-3.7.12-xss-via-url-parameter-on-login-page"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-71463.json b/data/2025/CVE-2025-71463.json index f2c7d439c1..a9af6fbdce 100644 --- a/data/2025/CVE-2025-71463.json +++ b/data/2025/CVE-2025-71463.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/scapy","product":"scapy","vendor":"secdev","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.7.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__()."},{"lang":"es","value":"Scapy antes de la versión 2.7.0 contiene una vulnerabilidad de deserialización insegura en la función load_session que permite a los atacantes ejecutar código suministrando un archivo de sesión malicioso de pickle. Los atacantes pueden engañar a los usuarios para que carguen un archivo .pkl.gz fabricado a través de la opción -s o conf.session, ejecutando el código de Python embutido a través de __reduce__()”."}],"id":"CVE-2025-71463","lastModified":"2026-11-13T21:17:35.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71463","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T20:34:57.242804Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:24.403","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/secdev/scapy/security/advisories/GHSA-cq46-m9x9-j8w2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/scapy-before-2.7.0-insecure-deserialization-rce-via-session-files"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/scapy","product":"scapy","vendor":"secdev","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.7.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__()."},{"lang":"es","value":"Scapy en versiones anteriores a la 2.7.0 contiene una vulnerabilidad de deserialización insegura en la función load_session que permite a los atacantes ejecutar código suministrando un archivo de sesión pickle malicioso. Los atacantes pueden engañar a los usuarios para que carguen un archivo .pkl.gz manipulado mediante la opción -s o conf.session, ejecutando código Python embebido a través de __reduce__()."}],"id":"CVE-2025-71463","lastModified":"2026-11-13T23:10:00.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71463","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T20:34:57.242804Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:24.403","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/secdev/scapy/security/advisories/GHSA-cq46-m9x9-j8w2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/scapy-before-2.7.0-insecure-deserialization-rce-via-session-files"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119077.json b/data/2026/CVE-2026-119077.json index 8f13a7cadc..2276fad8e0 100644 --- a/data/2026/CVE-2026-119077.json +++ b/data/2026/CVE-2026-119077.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ELEX WordPress HelpDesk & Customer Ticketing System","vendor":"elextensions","versions":[{"lessThanOrEqual":"3.3.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack."}],"id":"CVE-2026-119077","lastModified":"2026-11-13T10:17:26.613","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:26.483","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions-two.php#L156"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions-two.php#L265"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions.php#L946"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-init-handler.php#L529"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-public-functions.php#L627"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-public-functions.php#L822"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/vendor/guzzlehttp/guzzle/src/Cookie/FileCookieJar.php#L45"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3797458/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-public-functions.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f14b07ce-8893-4f8c-a501-5da6ec5a3b8f?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@wordfence.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ELEX WordPress HelpDesk & Customer Ticketing System","vendor":"elextensions","versions":[{"lessThanOrEqual":"3.3.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack."}],"id":"CVE-2026-119077","lastModified":"2026-11-13T23:17:13.633","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119077","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:42:09.202776Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:26.483","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions-two.php#L156"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions-two.php#L265"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions.php#L946"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-init-handler.php#L529"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-public-functions.php#L627"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-public-functions.php#L822"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/vendor/guzzlehttp/guzzle/src/Cookie/FileCookieJar.php#L45"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3797458/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-public-functions.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f14b07ce-8893-4f8c-a501-5da6ec5a3b8f?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@wordfence.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121518.json b/data/2026/CVE-2026-121518.json index 2ac942a40d..0379a048d3 100644 --- a/data/2026/CVE-2026-121518.json +++ b/data/2026/CVE-2026-121518.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Customer Reviews for WooCommerce","vendor":"ivole","versions":[{"lessThanOrEqual":"5.127.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring."}],"id":"CVE-2026-121518","lastModified":"2026-11-13T10:17:27.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:27.300","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L26"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L407"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L584"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L159"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L175"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L24"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L284"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3791702/"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3791702/customer-reviews-woocommerce/trunk/includes/blocks/class-cr-all-reviews.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93acf29-8ff0-4412-9ff0-161f154b4311?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@wordfence.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Customer Reviews for WooCommerce","vendor":"ivole","versions":[{"lessThanOrEqual":"5.127.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring."}],"id":"CVE-2026-121518","lastModified":"2026-11-13T23:17:13.783","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121518","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:28.532475Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:27.300","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L26"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L407"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/blocks/class-cr-all-reviews.php#L584"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L159"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L175"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L24"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.126.0/includes/reviews/class-cr-ajax-reviews.php#L284"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3791702/"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3791702/customer-reviews-woocommerce/trunk/includes/blocks/class-cr-all-reviews.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93acf29-8ff0-4412-9ff0-161f154b4311?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@wordfence.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124002.json b/data/2026/CVE-2026-124002.json index 4f63eeebe0..ac8a40a3cf 100644 --- a/data/2026/CVE-2026-124002.json +++ b/data/2026/CVE-2026-124002.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.7.0","status":"affected","version":"5.2.3","versionType":"semver"},{"status":"unaffected","version":"5.7.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124002","lastModified":"2026-11-13T15:17:34.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:21.597","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-authentication-os-command-injection-via-username"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.7.0","status":"affected","version":"5.2.3","versionType":"semver"},{"status":"unaffected","version":"5.7.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124002","lastModified":"2026-11-13T23:17:13.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124002","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:54:45.416140Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:21.597","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-authentication-os-command-injection-via-username"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124006.json b/data/2026/CVE-2026-124006.json index 1bfafc479c..a2291db0ef 100644 --- a/data/2026/CVE-2026-124006.json +++ b/data/2026/CVE-2026-124006.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124006","lastModified":"2026-11-13T15:17:34.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:23.033","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-root-password-generation"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"},{"lang":"en","value":"CWE-1392"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124006","lastModified":"2026-11-13T23:17:14.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124006","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:48:37.996395Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:23.033","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-root-password-generation"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"},{"lang":"en","value":"CWE-1392"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124010.json b/data/2026/CVE-2026-124010.json index 44fa931d7e..c362da2255 100644 --- a/data/2026/CVE-2026-124010.json +++ b/data/2026/CVE-2026-124010.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124010","lastModified":"2026-11-13T15:17:35.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:24.263","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-command-injection-via-xwconsole-cgi"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-250"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThan":"5.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124010","lastModified":"2026-11-13T23:17:14.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124010","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:54:47.969764Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:24.263","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-command-injection-via-xwconsole-cgi"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-250"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124014.json b/data/2026/CVE-2026-124014.json index 29a5b12202..0939b228db 100644 --- a/data/2026/CVE-2026-124014.json +++ b/data/2026/CVE-2026-124014.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"4.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which performs no session validation and writes the raw, unvalidated request body. Attackers can tamper with configuration values such as model and plugin fields or trigger a SYSTEM_NOT_CONFIGURED state via the unauthenticated action=get and action=set operations, resulting in configuration tampering and denial of service. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124014","lastModified":"2026-11-13T15:17:35.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T20:18:25.590","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-configuration-write-via-config-lua"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XWEB EVO","vendor":"Copeland","versions":[{"lessThanOrEqual":"5.8.8","status":"affected","version":"4.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which performs no session validation and writes the raw, unvalidated request body. Attackers can tamper with configuration values such as model and plugin fields or trigger a SYSTEM_NOT_CONFIGURED state via the unauthenticated action=get and action=set operations, resulting in configuration tampering and denial of service. This product line reached it's end of service date in March 2026."}],"id":"CVE-2026-124014","lastModified":"2026-11-13T23:17:14.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124014","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:54:08.076521Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:25.590","references":[{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate"},{"source":"disclosure@vulncheck.com","url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-configuration-write-via-config-lua"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/blog/copeland-xweb-evo-unauthenticated-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124666.json b/data/2026/CVE-2026-124666.json index b309599f6c..be355dc97e 100644 --- a/data/2026/CVE-2026-124666.json +++ b/data/2026/CVE-2026-124666.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"3.8.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by spoofing vulnerability in Apache APISIX.\n\n\n\nOn a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator.\n\n\n\nThis issue affects Apache APISIX: from 3.8.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124666","lastModified":"2026-11-13T18:17:31.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-13T18:17:31.260","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/1kpvbj2m069bnhod8rwyx0mdz5hkwkml"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"3.8.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by spoofing vulnerability in Apache APISIX.\n\n\n\nOn a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator.\n\n\n\nThis issue affects Apache APISIX: from 3.8.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124666","lastModified":"2026-11-13T23:17:14.420","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-13T18:17:31.260","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/1kpvbj2m069bnhod8rwyx0mdz5hkwkml"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/13/5"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124679.json b/data/2026/CVE-2026-124679.json index e0d37fd682..ea584792d2 100644 --- a/data/2026/CVE-2026-124679.json +++ b/data/2026/CVE-2026-124679.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"3.18.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by spoofing vulnerability in Apache APISIX.\n\n\n\nOn routes using jwe-decrypt with strict: false and a\nforward_header distinct from the token header an unauthenticated\nclient can supply the value the upstream treats as gateway-decrypted\nplaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable.\n\n\n\nThis issue affects Apache APISIX: from 3.18.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124679","lastModified":"2026-11-13T18:17:31.393","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-13T18:17:31.393","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/jmktj1o0rrxf1rdbptk0j3c4h0vdws96"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"3.18.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by spoofing vulnerability in Apache APISIX.\n\n\n\nOn routes using jwe-decrypt with strict: false and a\nforward_header distinct from the token header an unauthenticated\nclient can supply the value the upstream treats as gateway-decrypted\nplaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable.\n\n\n\nThis issue affects Apache APISIX: from 3.18.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124679","lastModified":"2026-11-13T23:17:14.517","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-13T18:17:31.393","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/jmktj1o0rrxf1rdbptk0j3c4h0vdws96"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/13/6"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124680.json b/data/2026/CVE-2026-124680.json index bdf39ba906..82a0f2ff32 100644 --- a/data/2026/CVE-2026-124680.json +++ b/data/2026/CVE-2026-124680.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"0.9","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX.\n\n\n\nAn unauthenticated client can reach upstream paths protected\nby a route-level auth plugin when a route without auth exists on the\nsame upstream and the upstream does not collapse encoded dot segments.\n\n\n\nThis issue affects Apache APISIX: from 0.9 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124680","lastModified":"2026-11-13T20:18:18.730","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:50:49.573399Z","version":"2.0.3"}}]},"published":"2026-11-13T18:17:31.533","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/tsr691p4s58572og5f88p831vygbflvz"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"0.9","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX.\n\n\n\nAn unauthenticated client can reach upstream paths protected\nby a route-level auth plugin when a route without auth exists on the\nsame upstream and the upstream does not collapse encoded dot segments.\n\n\n\nThis issue affects Apache APISIX: from 0.9 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124680","lastModified":"2026-11-13T23:17:14.623","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:50:49.573399Z","version":"2.0.3"}}]},"published":"2026-11-13T18:17:31.533","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/tsr691p4s58572og5f88p831vygbflvz"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/13/7"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124716.json b/data/2026/CVE-2026-124716.json index 771714af71..e9c8ca4728 100644 --- a/data/2026/CVE-2026-124716.json +++ b/data/2026/CVE-2026-124716.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"1.4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in Apache APISIX.\n\n\n\nAn authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied.\n\n\n\nThis issue affects Apache APISIX: from 1.4.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124716","lastModified":"2026-11-13T18:17:31.670","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-13T18:17:31.670","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/5kyz1fdbgx9to7lj654wqf72yhzy2po7"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"1.4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in Apache APISIX.\n\n\n\nAn authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied.\n\n\n\nThis issue affects Apache APISIX: from 1.4.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124716","lastModified":"2026-11-13T23:17:14.737","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-13T18:17:31.670","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/5kyz1fdbgx9to7lj654wqf72yhzy2po7"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/13/8"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124719.json b/data/2026/CVE-2026-124719.json index 30eade8c4e..a690d572bf 100644 --- a/data/2026/CVE-2026-124719.json +++ b/data/2026/CVE-2026-124719.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.20.0","status":"affected","version":"3.19.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by spoofing vulnerability in Apache APISIX.\n\n\n\nWhen a Route's configured headers carry a caller identity and the OpenAPI document declares\nthe same header, a caller can act as another identity against the\nupstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124719","lastModified":"2026-11-13T20:18:19.740","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124719","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:50:39.752278Z","version":"2.0.3"}}]},"published":"2026-11-13T18:17:31.803","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/k7v3vfh09mr1spk4r5k8n1gsjrhk6d8x"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.20.0","status":"affected","version":"3.19.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by spoofing vulnerability in Apache APISIX.\n\n\n\nWhen a Route's configured headers carry a caller identity and the OpenAPI document declares\nthe same header, a caller can act as another identity against the\nupstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124719","lastModified":"2026-11-13T23:17:14.843","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124719","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:50:39.752278Z","version":"2.0.3"}}]},"published":"2026-11-13T18:17:31.803","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/k7v3vfh09mr1spk4r5k8n1gsjrhk6d8x"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/13/9"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124723.json b/data/2026/CVE-2026-124723.json index 1cbae7b10f..287f092933 100644 --- a/data/2026/CVE-2026-124723.json +++ b/data/2026/CVE-2026-124723.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"3.18.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX.\n\n\n\nWith match_uri_encoded_slash enabled and skip_mtls_uri_regex\nconfigured, a client without a certificate can reach an upstream\nbehind a route that requires one, limited to request paths that decode\nto an exempted URI. This issue affects Apache APISIX: from 3.18.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124723","lastModified":"2026-11-13T20:18:20.753","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124723","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:49:56.142889Z","version":"2.0.3"}}]},"published":"2026-11-13T18:17:31.930","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/0r8dv4ytw5mkhrozlg7mgb9h6z5y7hpn"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"},{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"3.18.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX.\n\n\n\nWith match_uri_encoded_slash enabled and skip_mtls_uri_regex\nconfigured, a client without a certificate can reach an upstream\nbehind a route that requires one, limited to request paths that decode\nto an exempted URI. This issue affects Apache APISIX: from 3.18.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124723","lastModified":"2026-11-13T23:17:14.960","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124723","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:49:56.142889Z","version":"2.0.3"}}]},"published":"2026-11-13T18:17:31.930","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/0r8dv4ytw5mkhrozlg7mgb9h6z5y7hpn"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/13/10"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"},{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-124726.json b/data/2026/CVE-2026-124726.json index 49475b3fea..134c6cfc08 100644 --- a/data/2026/CVE-2026-124726.json +++ b/data/2026/CVE-2026-124726.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.20.0","status":"affected","version":"3.19.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.\n\n\n\nA caller of the MCP endpoint can invoke endpoints the OpenAPI document\nnever declared, under the declared tool's HTTP method, using the credentials the\nRoute adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124726","lastModified":"2026-11-13T20:18:21.763","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124726","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:49:40.828881Z","version":"2.0.3"}}]},"published":"2026-11-13T18:17:32.050","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/1kodokhflvr51sc1qv985om3s6mozybg"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.20.0","status":"affected","version":"3.19.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.\n\n\n\nA caller of the MCP endpoint can invoke endpoints the OpenAPI document\nnever declared, under the declared tool's HTTP method, using the credentials the\nRoute adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124726","lastModified":"2026-11-13T23:17:15.080","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124726","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T19:49:40.828881Z","version":"2.0.3"}}]},"published":"2026-11-13T18:17:32.050","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/1kodokhflvr51sc1qv985om3s6mozybg"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/13/11"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125055.json b/data/2026/CVE-2026-125055.json index 69dbe6d0a9..aa99483007 100644 --- a/data/2026/CVE-2026-125055.json +++ b/data/2026/CVE-2026-125055.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Chatterbug Forms – Fast, Flexible WordPress Form Builder","vendor":"sameh101","versions":[{"lessThanOrEqual":"1.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier."}],"id":"CVE-2026-125055","lastModified":"2026-11-13T10:17:28.277","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:28.153","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L308"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L331"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L422"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L510"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3794492/chatterbug-forms/trunk/chatterbug-forms.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7819c1fa-884b-4f1d-ba63-84057bf6da84?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"security@wordfence.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Chatterbug Forms – Fast, Flexible WordPress Form Builder","vendor":"sameh101","versions":[{"lessThanOrEqual":"1.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier."}],"id":"CVE-2026-125055","lastModified":"2026-11-13T23:17:15.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125055","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:42:06.613916Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:28.153","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L308"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L331"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L422"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/chatterbug-forms/tags/1.0.2/chatterbug-forms.php#L510"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3794492/chatterbug-forms/trunk/chatterbug-forms.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7819c1fa-884b-4f1d-ba63-84057bf6da84?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"security@wordfence.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126190.json b/data/2026/CVE-2026-126190.json index 2ddcdef182..d64a6c16f3 100644 --- a/data/2026/CVE-2026-126190.json +++ b/data/2026/CVE-2026-126190.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"soupsieve","vendor":"facelessuser","versions":[{"status":"affected","version":"< 4.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested attacker-influenced HTML or XML. Applications using selectors such as section div div through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while trusted-only document processing is not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0."}],"id":"CVE-2026-126190","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T17:17:32.440","references":[{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/commit/ff1a5ce7e5addc31626d7b6053511fecdb4f6320"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/pull/351"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/releases/tag/4.0"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-mmhr-3c5m-f64f"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"soupsieve","vendor":"facelessuser","versions":[{"status":"affected","version":"< 4.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested attacker-influenced HTML or XML. Applications using selectors such as section div div through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while trusted-only document processing is not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0."}],"id":"CVE-2026-126190","lastModified":"2026-11-13T23:17:15.307","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126190","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:33:51.153778Z","version":"2.0.3"}}]},"published":"2026-11-12T17:17:32.440","references":[{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/commit/ff1a5ce7e5addc31626d7b6053511fecdb4f6320"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/pull/351"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/releases/tag/4.0"},{"source":"security-advisories@github.com","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-mmhr-3c5m-f64f"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126206.json b/data/2026/CVE-2026-126206.json index b6251b16ec..a5a09fda38 100644 --- a/data/2026/CVE-2026-126206.json +++ b/data/2026/CVE-2026-126206.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"loofah","vendor":"flavorjones","versions":[{"status":"affected","version":"= 2.25.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed and falls back to the allowed text/plain, while a browser decodes the reference and interprets the same value as text/html. An application that validates a user-controlled URL with this helper and renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting. Rails::HTML::Sanitizer.allowed_uri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes the entity before URI validation. This issue is fixed in version 2.25.3."}],"id":"CVE-2026-126206","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T21:17:21.670","references":[{"source":"security-advisories@github.com","url":"https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744"},{"source":"security-advisories@github.com","url":"https://github.com/flavorjones/loofah/pull/324"},{"source":"security-advisories@github.com","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"source":"security-advisories@github.com","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-184"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"loofah","vendor":"flavorjones","versions":[{"status":"affected","version":"= 2.25.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed and falls back to the allowed text/plain, while a browser decodes the reference and interprets the same value as text/html. An application that validates a user-controlled URL with this helper and renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting. Rails::HTML::Sanitizer.allowed_uri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes the entity before URI validation. This issue is fixed in version 2.25.3."}],"id":"CVE-2026-126206","lastModified":"2026-11-13T23:17:15.420","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126206","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:33:59.076823Z","version":"2.0.3"}}]},"published":"2026-11-12T21:17:21.670","references":[{"source":"security-advisories@github.com","url":"https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744"},{"source":"security-advisories@github.com","url":"https://github.com/flavorjones/loofah/pull/324"},{"source":"security-advisories@github.com","url":"https://github.com/flavorjones/loofah/releases/tag/v2.25.3"},{"source":"security-advisories@github.com","url":"https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-184"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126210.json b/data/2026/CVE-2026-126210.json index 8f489b3200..6abd34c0df 100644 --- a/data/2026/CVE-2026-126210.json +++ b/data/2026/CVE-2026-126210.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"node-server","vendor":"honojs","versions":[{"status":"affected","version":">= 2.0.0, < 2.1.6"},{"status":"affected","version":"< 1.19.18"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse proxy, load balancer, or web application firewall that preserves the backslash and applies path-based rules to the original request can therefore permit a request that the application normalizes to a blocked route. This lets an unauthenticated client reach route content that the upstream component was intended to deny, while Hono application access controls are unaffected because they operate on the normalized path. This issue is fixed in versions 1.19.18 and 2.1.6."}],"id":"CVE-2026-126210","lastModified":"2026-11-12T22:19:18.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:18.967","references":[{"source":"security-advisories@github.com","url":"https://github.com/honojs/node-server/commit/3868998a805ae79216535ad3986c1e7228dee313"},{"source":"security-advisories@github.com","url":"https://github.com/honojs/node-server/commit/fb97395ec36af66567c76976e741110b02804d1c"},{"source":"security-advisories@github.com","url":"https://github.com/honojs/node-server/releases/tag/v1.19.18"},{"source":"security-advisories@github.com","url":"https://github.com/honojs/node-server/releases/tag/v2.1.6"},{"source":"security-advisories@github.com","url":"https://github.com/honojs/node-server/security/advisories/GHSA-jpvv-r467-5p4w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"node-server","vendor":"honojs","versions":[{"status":"affected","version":">= 2.0.0, < 2.1.6"},{"status":"affected","version":"< 1.19.18"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse proxy, load balancer, or web application firewall that preserves the backslash and applies path-based rules to the original request can therefore permit a request that the application normalizes to a blocked route. This lets an unauthenticated client reach route content that the upstream component was intended to deny, while Hono application access controls are unaffected because they operate on the normalized path. This issue is fixed in versions 1.19.18 and 2.1.6."}],"id":"CVE-2026-126210","lastModified":"2026-11-13T23:17:15.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126210","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:02.514763Z","version":"2.0.3"}}]},"published":"2026-11-12T22:19:18.967","references":[{"source":"security-advisories@github.com","url":"https://github.com/honojs/node-server/commit/3868998a805ae79216535ad3986c1e7228dee313"},{"source":"security-advisories@github.com","url":"https://github.com/honojs/node-server/commit/fb97395ec36af66567c76976e741110b02804d1c"},{"source":"security-advisories@github.com","url":"https://github.com/honojs/node-server/releases/tag/v1.19.18"},{"source":"security-advisories@github.com","url":"https://github.com/honojs/node-server/releases/tag/v2.1.6"},{"source":"security-advisories@github.com","url":"https://github.com/honojs/node-server/security/advisories/GHSA-jpvv-r467-5p4w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126266.json b/data/2026/CVE-2026-126266.json index 20c54afb5f..499be90279 100644 --- a/data/2026/CVE-2026-126266.json +++ b/data/2026/CVE-2026-126266.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/SiYuan","product":"siyuan","vendor":"siyuan-note","versions":[{"lessThan":"3.8.9","status":"affected","version":"3.6.0","versionType":"semver"},{"status":"unaffected","version":"3.8.9","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field."}],"id":"CVE-2026-126266","lastModified":"2026-11-13T10:17:29.307","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:29.173","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qf37-w288-frvq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/siyuan-from-3.6.0-before-3.8.9-publish-password-bypass-via-getdoc-regex-keywords"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/SiYuan","product":"siyuan","vendor":"siyuan-note","versions":[{"lessThan":"3.8.9","status":"affected","version":"3.6.0","versionType":"semver"},{"status":"unaffected","version":"3.8.9","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field."}],"id":"CVE-2026-126266","lastModified":"2026-11-13T23:17:15.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126266","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:44.840454Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:29.173","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qf37-w288-frvq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/siyuan-from-3.6.0-before-3.8.9-publish-password-bypass-via-getdoc-regex-keywords"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126270.json b/data/2026/CVE-2026-126270.json index dd6e8929ed..8044a76312 100644 --- a/data/2026/CVE-2026-126270.json +++ b/data/2026/CVE-2026-126270.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.09.1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.09.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load."}],"id":"CVE-2026-126270","lastModified":"2026-11-13T10:17:29.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:29.827","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-5892-3964-gc52"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.09.1-unauthenticated-information-disclosure-via-aggregated-meta-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.09.1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.09.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load."}],"id":"CVE-2026-126270","lastModified":"2026-11-13T23:17:15.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126270","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:41.826756Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:29.827","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-5892-3964-gc52"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.09.1-unauthenticated-information-disclosure-via-aggregated-meta-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126278.json b/data/2026/CVE-2026-126278.json index a45577d074..706c568715 100644 --- a/data/2026/CVE-2026-126278.json +++ b/data/2026/CVE-2026-126278.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out."}],"id":"CVE-2026-126278","lastModified":"2026-11-13T10:17:31.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:31.053","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-7mf9-q77p-r4r3"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-password-reset-token-race-condition"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out."}],"id":"CVE-2026-126278","lastModified":"2026-11-13T23:17:15.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126278","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:38.890271Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:31.053","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-7mf9-q77p-r4r3"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.1-password-reset-token-race-condition"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126286.json b/data/2026/CVE-2026-126286.json index 8afb157c5e..5a4ffdef50 100644 --- a/data/2026/CVE-2026-126286.json +++ b/data/2026/CVE-2026-126286.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check and reaches the anchor href or window.location, stealing the session token from localStorage for account takeover."}],"id":"CVE-2026-126286","lastModified":"2026-11-13T10:17:32.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:32.287","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-x3wx-294c-4p48"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-reflected-xss-via-ncredirecturl-in-pageleavingwarning-vue"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.08.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses the scheme check and reaches the anchor href or window.location, stealing the session token from localStorage for account takeover."}],"id":"CVE-2026-126286","lastModified":"2026-11-13T23:17:16.023","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126286","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:42:12.518708Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:32.287","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-x3wx-294c-4p48"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-reflected-xss-via-ncredirecturl-in-pageleavingwarning-vue"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126294.json b/data/2026/CVE-2026-126294.json index 86d21ca1d0..9e49adc252 100644 --- a/data/2026/CVE-2026-126294.json +++ b/data/2026/CVE-2026-126294.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"grav","vendor":"getgrav","versions":[{"lessThan":"3.11.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.11.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a session the API plugin accepts, gaining full account permissions including super-admin control."}],"id":"CVE-2026-126294","lastModified":"2026-11-13T10:17:34.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:33.890","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/getgrav/grav/security/advisories/GHSA-4x9h-4683-5fcx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/grav-login-plugin-before-3.11.0-two-factor-authentication-bypass-via-login"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"grav","vendor":"getgrav","versions":[{"lessThan":"3.11.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.11.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a session the API plugin accepts, gaining full account permissions including super-admin control."}],"id":"CVE-2026-126294","lastModified":"2026-11-13T23:17:16.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126294","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:36.151687Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:33.890","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/getgrav/grav/security/advisories/GHSA-4x9h-4683-5fcx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/grav-login-plugin-before-3.11.0-two-factor-authentication-bypass-via-login"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126298.json b/data/2026/CVE-2026-126298.json index b12c04789b..93a4464b4f 100644 --- a/data/2026/CVE-2026-126298.json +++ b/data/2026/CVE-2026-126298.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread."}],"id":"CVE-2026-126298","lastModified":"2026-11-13T10:17:34.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:34.580","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-r53h-rw34-8h97"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-before-3.10.4-quadratic-cpu-denial-of-service-via-tree-chomsky-normal-form"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","product":"nltk","vendor":"nltk","versions":[{"lessThan":"3.10.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"3.10.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread."}],"id":"CVE-2026-126298","lastModified":"2026-11-13T23:17:16.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126298","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:33.596773Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:34.580","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-r53h-rw34-8h97"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nltk-before-3.10.4-quadratic-cpu-denial-of-service-via-tree-chomsky-normal-form"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126358.json b/data/2026/CVE-2026-126358.json index e5059e851d..cd99e65401 100644 --- a/data/2026/CVE-2026-126358.json +++ b/data/2026/CVE-2026-126358.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"hono","vendor":"honojs","versions":[{"status":"affected","version":">= 4.1.4, < 4.13.16"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant{[^/]+}/admin/* is not applied to a route written as /api/:tenant/admin/:id; since 4.1.4, middleware on /admin/* is not applied to a route registered as /admin* for paths under /admin/; and since 4.4.0, a request path containing an encoded line terminator can reach the not-found handler without wildcard middleware. The default SmartRouter selects RegExpRouter for most applications, and the router's registration-time coverage calculation treated the first two matching pattern pairs as different while its compiled wildcard did not match line terminators in the third case. An unauthenticated client can reach a route handler or the not-found handler without authentication or authorization middleware registered on the wildcard path. TrieRouter, LinearRouter, and PatternRouter apply the middleware in the three described cases. This issue is fixed in version 4.13.16."}],"id":"CVE-2026-126358","lastModified":"2026-11-13T00:20:11.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T00:20:11.050","references":[{"source":"security-advisories@github.com","url":"https://github.com/honojs/hono/commit/8a103aa59bcfbffd5396b1548a0dff3688777c36"},{"source":"security-advisories@github.com","url":"https://github.com/honojs/hono/releases/tag/v4.13.16"},{"source":"security-advisories@github.com","url":"https://github.com/honojs/hono/security/advisories/GHSA-h7mg-cq63-vhpq"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"hono","vendor":"honojs","versions":[{"status":"affected","version":">= 4.1.4, < 4.13.16"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant{[^/]+}/admin/* is not applied to a route written as /api/:tenant/admin/:id; since 4.1.4, middleware on /admin/* is not applied to a route registered as /admin* for paths under /admin/; and since 4.4.0, a request path containing an encoded line terminator can reach the not-found handler without wildcard middleware. The default SmartRouter selects RegExpRouter for most applications, and the router's registration-time coverage calculation treated the first two matching pattern pairs as different while its compiled wildcard did not match line terminators in the third case. An unauthenticated client can reach a route handler or the not-found handler without authentication or authorization middleware registered on the wildcard path. TrieRouter, LinearRouter, and PatternRouter apply the middleware in the three described cases. This issue is fixed in version 4.13.16."}],"id":"CVE-2026-126358","lastModified":"2026-11-13T23:17:16.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126358","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:05.950866Z","version":"2.0.3"}}]},"published":"2026-11-13T00:20:11.050","references":[{"source":"security-advisories@github.com","url":"https://github.com/honojs/hono/commit/8a103aa59bcfbffd5396b1548a0dff3688777c36"},{"source":"security-advisories@github.com","url":"https://github.com/honojs/hono/releases/tag/v4.13.16"},{"source":"security-advisories@github.com","url":"https://github.com/honojs/hono/security/advisories/GHSA-h7mg-cq63-vhpq"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126366.json b/data/2026/CVE-2026-126366.json index 7c3903cde7..e3d49d4bab 100644 --- a/data/2026/CVE-2026-126366.json +++ b/data/2026/CVE-2026-126366.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"msgpack-ruby","vendor":"msgpack","versions":[{"status":"affected","version":"< 1.8.7"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding elements or bytes were available. A short MessagePack header could therefore trigger a very large allocation or sustained heap growth when an application decoded untrusted input through MessagePack.unpack or MessagePack::Unpacker, potentially exhausting the shared JVM heap. map32 and declared counts at or above 2^31 did not use the affected allocation behavior. This issue is fixed in version 1.8.7."}],"id":"CVE-2026-126366","lastModified":"2026-11-13T00:20:12.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T00:20:12.397","references":[{"source":"security-advisories@github.com","url":"https://github.com/msgpack/msgpack-ruby/commit/ca0efc1256c687b428c46dd68ce000ff515d53f2"},{"source":"security-advisories@github.com","url":"https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.6"},{"source":"security-advisories@github.com","url":"https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.7"},{"source":"security-advisories@github.com","url":"https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-73v3-wf97-vpgj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"},{"lang":"en","value":"CWE-1325"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"msgpack-ruby","vendor":"msgpack","versions":[{"status":"affected","version":"< 1.8.7"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding elements or bytes were available. A short MessagePack header could therefore trigger a very large allocation or sustained heap growth when an application decoded untrusted input through MessagePack.unpack or MessagePack::Unpacker, potentially exhausting the shared JVM heap. map32 and declared counts at or above 2^31 did not use the affected allocation behavior. This issue is fixed in version 1.8.7."}],"id":"CVE-2026-126366","lastModified":"2026-11-13T23:17:16.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126366","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:09.602041Z","version":"2.0.3"}}]},"published":"2026-11-13T00:20:12.397","references":[{"source":"security-advisories@github.com","url":"https://github.com/msgpack/msgpack-ruby/commit/ca0efc1256c687b428c46dd68ce000ff515d53f2"},{"source":"security-advisories@github.com","url":"https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.6"},{"source":"security-advisories@github.com","url":"https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.7"},{"source":"security-advisories@github.com","url":"https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-73v3-wf97-vpgj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"},{"lang":"en","value":"CWE-1325"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126395.json b/data/2026/CVE-2026-126395.json index 2f718f3826..d6522a65a6 100644 --- a/data/2026/CVE-2026-126395.json +++ b/data/2026/CVE-2026-126395.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/vllm","product":"vllm","vendor":"vllm-project","versions":[{"lessThan":"0.31.0","status":"affected","version":"0.14.0rc1","versionType":"custom"},{"status":"unaffected","version":"0.31.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /tokenize, triggering HF-processor errors that leak live server heap addresses useful for ASLR bypass."}],"id":"CVE-2026-126395","lastModified":"2026-11-13T10:17:43.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:43.577","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-m9fg-w9qh-67pc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vllm-0.14-0rc1-before-0.31.0-heap-address-disclosure-via-sanitize-message"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/vllm","product":"vllm","vendor":"vllm-project","versions":[{"lessThan":"0.31.0","status":"affected","version":"0.14.0rc1","versionType":"custom"},{"status":"unaffected","version":"0.31.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /tokenize, triggering HF-processor errors that leak live server heap addresses useful for ASLR bypass."}],"id":"CVE-2026-126395","lastModified":"2026-11-13T23:17:16.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126395","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:31.048655Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:43.577","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-m9fg-w9qh-67pc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vllm-0.14-0rc1-before-0.31.0-heap-address-disclosure-via-sanitize-message"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126955.json b/data/2026/CVE-2026-126955.json index fe175be854..6f4690ef7d 100644 --- a/data/2026/CVE-2026-126955.json +++ b/data/2026/CVE-2026-126955.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/glanceapp/glance","product":"glance","repo":"https://github.com/glanceapp/glance","vendor":"glanceapp","versions":[{"lessThan":"0.8.8","status":"affected","version":"0.8.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names."}],"id":"CVE-2026-126955","lastModified":"2026-11-13T15:53:39.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.060","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/glance.go#L306-L316"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/releases/tag/v0.8.8"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/security/advisories/GHSA-294x-cjq2-6j5r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/glance-0.8.0-before-0.8.8-page-slug-enumeration-via-response-discrepancy"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-204"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/glanceapp/glance","product":"glance","repo":"https://github.com/glanceapp/glance","vendor":"glanceapp","versions":[{"lessThan":"0.8.8","status":"affected","version":"0.8.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names."}],"id":"CVE-2026-126955","lastModified":"2026-11-13T23:17:16.837","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126955","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:25.738695Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:03.060","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/glance.go#L306-L316"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/releases/tag/v0.8.8"},{"source":"disclosure@vulncheck.com","url":"https://github.com/glanceapp/glance/security/advisories/GHSA-294x-cjq2-6j5r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/glance-0.8.0-before-0.8.8-page-slug-enumeration-via-response-discrepancy"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-204"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127029.json b/data/2026/CVE-2026-127029.json index 782275636a..ba51e2e7a3 100644 --- a/data/2026/CVE-2026-127029.json +++ b/data/2026/CVE-2026-127029.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"freeradius","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"freeradius","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"freeradius","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"freeradius:3.0/freeradius","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"freeradius","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS)."}],"id":"CVE-2026-127029","lastModified":"2026-11-12T17:17:43.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-12T17:17:42.970","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-127029"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2572339"},{"source":"secalert@redhat.com","url":"https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9"},{"source":"secalert@redhat.com","url":"https://github.com/FreeRADIUS/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"freeradius","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"freeradius","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"freeradius","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"freeradius:3.0/freeradius","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"freeradius","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS)."}],"id":"CVE-2026-127029","lastModified":"2026-11-13T23:17:16.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127029","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:33:48.529185Z","version":"2.0.3"}}]},"published":"2026-11-12T17:17:42.970","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-127029"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2572339"},{"source":"secalert@redhat.com","url":"https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9"},{"source":"secalert@redhat.com","url":"https://github.com/FreeRADIUS/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127076.json b/data/2026/CVE-2026-127076.json index 34b754f742..b7acbb66e3 100644 --- a/data/2026/CVE-2026-127076.json +++ b/data/2026/CVE-2026-127076.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects' source code, manifests, and committed secrets."}],"id":"CVE-2026-127076","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:03.680","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/2c7f64bebb810f565223b6916551df36"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-broken-access-control-via-git-repo-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects' source code, manifests, and committed secrets."}],"id":"CVE-2026-127076","lastModified":"2026-11-13T23:17:17.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127076","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:42:55.474305Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:03.680","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/2c7f64bebb810f565223b6916551df36"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-broken-access-control-via-git-repo-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-12708.json b/data/2026/CVE-2026-12708.json index 74b05e10c6..a2df3d4c31 100644 --- a/data/2026/CVE-2026-12708.json +++ b/data/2026/CVE-2026-12708.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"tokio-quiche","repo":"https://github.com/cloudflare/quiche/tree/master/tokio-quiche","vendor":"Cloudflare","versions":[{"lessThanOrEqual":"0.20.1","status":"affected","version":"0.0.1","versionType":"semver"}]}],"source":"cna@cloudflare.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Summary\n\n\nCloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling. For every previously unseen flow identifier (quarter stream ID) received in a DATAGRAM frame, tokio-quiche creates and retains new, per-flow state. A remote peer can send DATAGRAMs with many distinct identifiers, causing the per-connection flow map and associated channel state to grow without bound.\n\nImpact\n\n\nExploitation can exhaust process memory and cause a denial of service. The vulnerable code is used in both client and server configurations, so either role can be affected by a malicious peer. QUIC DATAGRAM support in tokio-quiche is enabled by default through QuicSettings::enable_dgram; applications can disable it by setting this field to false. The vulnerable HTTP/3 path is reachable only when DATAGRAM support is negotiated with the peer. Core quiche and HTTP/3 deployments without DATAGRAM support are not affected. \n\n\n\n\n\n\nMitigation\n\n\nDisable DATAGRAMs in tokio-quiche’s QuicSettings::enable_dgram.\n\n\n\n\n\n\nRemediation\n\n\nUpgrade to tokio-quiche version 0.23.0 or later. The fixed code creates flow state only for valid DATAGRAM-capable request streams, which are bounded by QUIC’s stream limits. To tolerate packet reordering, servers retain early DATAGRAMs in a bounded, expiring buffer, while clients discard DATAGRAMs for unknown flows."}],"id":"CVE-2026-12708","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@cloudflare.com","type":"Secondary"}]},"published":"2026-11-10T14:17:29.980","references":[{"source":"cna@cloudflare.com","url":"https://github.com/cloudflare/quiche/security/advisories/GHSA-wcm9-jv39-r963"},{"source":"cna@cloudflare.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-12708"}],"sourceIdentifier":"cna@cloudflare.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"cna@cloudflare.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"tokio-quiche","repo":"https://github.com/cloudflare/quiche/tree/master/tokio-quiche","vendor":"Cloudflare","versions":[{"lessThanOrEqual":"0.20.1","status":"affected","version":"0.0.1","versionType":"semver"}]}],"source":"cna@cloudflare.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Summary\n\n\nCloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling. For every previously unseen flow identifier (quarter stream ID) received in a DATAGRAM frame, tokio-quiche creates and retains new, per-flow state. A remote peer can send DATAGRAMs with many distinct identifiers, causing the per-connection flow map and associated channel state to grow without bound.\n\nImpact\n\n\nExploitation can exhaust process memory and cause a denial of service. The vulnerable code is used in both client and server configurations, so either role can be affected by a malicious peer. QUIC DATAGRAM support in tokio-quiche is enabled by default through QuicSettings::enable_dgram; applications can disable it by setting this field to false. The vulnerable HTTP/3 path is reachable only when DATAGRAM support is negotiated with the peer. Core quiche and HTTP/3 deployments without DATAGRAM support are not affected. \n\n\n\n\n\n\nMitigation\n\n\nDisable DATAGRAMs in tokio-quiche’s QuicSettings::enable_dgram.\n\n\n\n\n\n\nRemediation\n\n\nUpgrade to tokio-quiche version 0.23.0 or later. The fixed code creates flow state only for valid DATAGRAM-capable request streams, which are bounded by QUIC’s stream limits. To tolerate packet reordering, servers retain early DATAGRAMs in a bounded, expiring buffer, while clients discard DATAGRAMs for unknown flows."}],"id":"CVE-2026-12708","lastModified":"2026-11-13T23:17:19.340","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@cloudflare.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-12708","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:33:45.566975Z","version":"2.0.3"}}]},"published":"2026-11-10T14:17:29.980","references":[{"source":"cna@cloudflare.com","url":"https://github.com/cloudflare/quiche/security/advisories/GHSA-wcm9-jv39-r963"},{"source":"cna@cloudflare.com","url":"https://www.cve.org/CVERecord?id=CVE-2026-12708"}],"sourceIdentifier":"cna@cloudflare.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"cna@cloudflare.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127080.json b/data/2026/CVE-2026-127080.json index 6b5d49fc29..ee3acc9e19 100644 --- a/data/2026/CVE-2026-127080.json +++ b/data/2026/CVE-2026-127080.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise."}],"id":"CVE-2026-127080","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:04.260","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/b8c1cf47f829c28086fe78d8187eb938"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-container-escape-via-unrestricted-hostpath-volumes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BuildPiper","vendor":"OpsTree Solutions","versions":[{"lessThan":"2.7.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise."}],"id":"CVE-2026-127080","lastModified":"2026-11-13T23:17:17.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127080","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:48:40.460621Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:04.260","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/b8c1cf47f829c28086fe78d8187eb938"},{"source":"disclosure@vulncheck.com","url":"https://www.buildpiper.io/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-buildpiper-before-2.7.0-container-escape-via-unrestricted-hostpath-volumes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127088.json b/data/2026/CVE-2026-127088.json index 16fcd42419..0fdad5edde 100644 --- a/data/2026/CVE-2026-127088.json +++ b/data/2026/CVE-2026-127088.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Bubka/2FAuth","product":"2FAuth","repo":"https://github.com/Bubka/2FAuth","vendor":"Bubka","versions":[{"lessThan":"9.0.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets."}],"id":"CVE-2026-127088","lastModified":"2026-11-13T15:54:09.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:05.457","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Http/Kernel.php#L47"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Notifications/WebauthnRecoveryNotification.php#L62-L64"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/releases/tag/v9.0.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/security/advisories/GHSA-v9qw-r94g-95qv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/2fauth-before-9.0.1-password-reset-poisoning-via-host-header"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Bubka/2FAuth","product":"2FAuth","repo":"https://github.com/Bubka/2FAuth","vendor":"Bubka","versions":[{"lessThan":"9.0.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets."}],"id":"CVE-2026-127088","lastModified":"2026-11-13T23:17:17.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127088","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:42:03.590743Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:05.457","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Http/Kernel.php#L47"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Notifications/WebauthnRecoveryNotification.php#L62-L64"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/releases/tag/v9.0.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Bubka/2FAuth/security/advisories/GHSA-v9qw-r94g-95qv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/2fauth-before-9.0.1-password-reset-poisoning-via-host-header"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127275.json b/data/2026/CVE-2026-127275.json index 758628c1b4..a62d52b99e 100644 --- a/data/2026/CVE-2026-127275.json +++ b/data/2026/CVE-2026-127275.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:h:linksys:ea8100:*:*:*:*:*:*:*:*"],"modules":["JNAP API"],"product":"EA8100","vendor":"Linksys","versions":[{"status":"affected","version":"1.0.3.216940"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in Linksys EA8100 1.0.3.216940. This issue affects the function SetRemoteSetting/SetUnsecuredWiFiWarning of the file ui_server.lua of the component JNAP API. This manipulation of the argument isEnabled/enabled causes missing authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-127275","lastModified":"2026-11-13T00:20:14.263","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":10.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":10.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-13T00:20:14.083","references":[{"source":"cna@vuldb.com","url":"https://github.com/geo-chen/oss/blob/main/Linksys.md#finding-3-unauthenticated-write-access-to-remote-management-pairing-state-and-unsecured-wifi-warning-flag"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-127275"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040997"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436430"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436430/cti"},{"source":"cna@vuldb.com","url":"https://www.linksys.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:h:linksys:ea8100:*:*:*:*:*:*:*:*"],"modules":["JNAP API"],"product":"EA8100","vendor":"Linksys","versions":[{"status":"affected","version":"1.0.3.216940"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in Linksys EA8100 1.0.3.216940. This issue affects the function SetRemoteSetting/SetUnsecuredWiFiWarning of the file ui_server.lua of the component JNAP API. This manipulation of the argument isEnabled/enabled causes missing authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-127275","lastModified":"2026-11-13T23:17:17.477","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"COMPLETE","baseScore":10.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":10.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127275","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:54:50.458984Z","version":"2.0.3"}}]},"published":"2026-11-13T00:20:14.083","references":[{"source":"cna@vuldb.com","url":"https://github.com/geo-chen/oss/blob/main/Linksys.md#finding-3-unauthenticated-write-access-to-remote-management-pairing-state-and-unsecured-wifi-warning-flag"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-127275"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040997"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436430"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436430/cti"},{"source":"cna@vuldb.com","url":"https://www.linksys.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127279.json b/data/2026/CVE-2026-127279.json index 3b64ec3495..186cc31317 100644 --- a/data/2026/CVE-2026-127279.json +++ b/data/2026/CVE-2026-127279.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:aip-pub:acps-community:*:*:*:*:*:*:*:*"],"modules":["Discovery Server"],"product":"ACPs-community","vendor":"AIP-PUB","versions":[{"status":"affected","version":"2.0"},{"status":"affected","version":"2.1"},{"status":"affected","version":"2.2.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in AIP-PUB ACPs-community up to 2.2.0. This impacts an unknown function of the file discovery-server/app/main.py of the component Discovery Server. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure."}],"id":"CVE-2026-127279","lastModified":"2026-11-13T02:18:55.060","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-13T02:18:54.907","references":[{"source":"cna@vuldb.com","url":"https://github.com/AIP-PUB/ACPs-community/"},{"source":"cna@vuldb.com","url":"https://github.com/AIP-PUB/ACPs-community/issues/12"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-127279"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040952"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436435"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436435/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:aip-pub:acps-community:*:*:*:*:*:*:*:*"],"modules":["Discovery Server"],"product":"ACPs-community","vendor":"AIP-PUB","versions":[{"status":"affected","version":"2.0"},{"status":"affected","version":"2.1"},{"status":"affected","version":"2.2.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in AIP-PUB ACPs-community up to 2.2.0. This impacts an unknown function of the file discovery-server/app/main.py of the component Discovery Server. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure."}],"id":"CVE-2026-127279","lastModified":"2026-11-13T23:17:17.623","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127279","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:54:10.653318Z","version":"2.0.3"}}]},"published":"2026-11-13T02:18:54.907","references":[{"source":"cna@vuldb.com","url":"https://github.com/AIP-PUB/ACPs-community/"},{"source":"cna@vuldb.com","url":"https://github.com/AIP-PUB/ACPs-community/issues/12"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-127279"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040952"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436435"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436435/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-127284.json b/data/2026/CVE-2026-127284.json index b0fff182ba..1a3ec3f320 100644 --- a/data/2026/CVE-2026-127284.json +++ b/data/2026/CVE-2026-127284.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:sourcecodester:food_ordering_system:*:*:*:*:*:*:*:*"],"modules":["Admin Write Handler"],"product":"Food Ordering System","vendor":"SourceCodester","versions":[{"status":"affected","version":"1.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/add_category.php of the component Admin Write Handler. Performing a manipulation of the argument title/description/price/current_image/featured/active/id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks."}],"id":"CVE-2026-127284","lastModified":"2026-11-13T02:18:55.820","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-13T02:18:55.677","references":[{"source":"cna@vuldb.com","url":"https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F2-Unauth-SQL-Injection.md"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-127284"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1041049"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436450"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436450/cti"},{"source":"cna@vuldb.com","url":"https://www.sourcecodester.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}],"source":"cna@vuldb.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:sourcecodester:food_ordering_system:*:*:*:*:*:*:*:*"],"modules":["Admin Write Handler"],"product":"Food Ordering System","vendor":"SourceCodester","versions":[{"status":"affected","version":"1.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/add_category.php of the component Admin Write Handler. Performing a manipulation of the argument title/description/price/current_image/featured/active/id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks."}],"id":"CVE-2026-127284","lastModified":"2026-11-13T23:17:17.763","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127284","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:54:13.366118Z","version":"2.0.3"}}]},"published":"2026-11-13T02:18:55.677","references":[{"source":"cna@vuldb.com","url":"https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F2-Unauth-SQL-Injection.md"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-127284"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1041049"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436450"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436450/cti"},{"source":"cna@vuldb.com","url":"https://www.sourcecodester.com/"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}],"source":"cna@vuldb.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-128134.json b/data/2026/CVE-2026-128134.json new file mode 100644 index 0000000000..fb8caadf69 --- /dev/null +++ b/data/2026/CVE-2026-128134.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"nltk","vendor":"nltk","versions":[{"status":"affected","version":"< 3.10.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.4, nltk.parse.dependencygraph.dot2img resolves the Graphviz dot executable through PATH but invokes the resulting absolute executable without routing through spawn_trusted, so resolve_trusted_executable ownership and writability validation and safe_env loader environment scrubbing do not run. A local low-privileged attacker who can write to a directory on a POSIX victim's PATH can plant or replace dot, and code executes as the victim when dot2img is called directly or DependencyGraph.repr_svg renders a graph. The current-working-directory-only bare-name vector is blocked and is not this vulnerability; this issue is the residual writable absolute PATH element bypass after CVE-2026-78680. This issue is fixed in version 3.10.4."}],"id":"CVE-2026-128134","lastModified":"2026-11-13T23:17:18.037","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T23:17:17.900","references":[{"source":"security-advisories@github.com","url":"https://github.com/nltk/nltk/commit/b002a7288c22db86fd6ca2d9526e3f91d6fda797"},{"source":"security-advisories@github.com","url":"https://github.com/nltk/nltk/pull/3887"},{"source":"security-advisories@github.com","url":"https://github.com/nltk/nltk/releases/tag/v3.10.4"},{"source":"security-advisories@github.com","url":"https://github.com/nltk/nltk/security/advisories/GHSA-7mxv-7h3q-9324"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-426"},{"lang":"en","value":"CWE-427"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-128238.json b/data/2026/CVE-2026-128238.json index 642eef6637..2ab36718e9 100644 --- a/data/2026/CVE-2026-128238.json +++ b/data/2026/CVE-2026-128238.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/scapy","product":"scapy","vendor":"secdev","versions":[{"lessThan":"2.8.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.8.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True."}],"id":"CVE-2026-128238","lastModified":"2026-11-13T15:54:09.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:11.520","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/secdev/scapy/security/advisories/GHSA-456h-w4v7-hvpr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/scapy-before-2.8.0-uncontrolled-recursion-dos-via-ber-sequence-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/scapy","product":"scapy","vendor":"secdev","versions":[{"lessThan":"2.8.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2.8.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True."}],"id":"CVE-2026-128238","lastModified":"2026-11-13T23:17:18.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128238","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:22.976360Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:11.520","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/secdev/scapy/security/advisories/GHSA-456h-w4v7-hvpr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/scapy-before-2.8.0-uncontrolled-recursion-dos-via-ber-sequence-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-128239.json b/data/2026/CVE-2026-128239.json index a2f82460dc..8244564338 100644 --- a/data/2026/CVE-2026-128239.json +++ b/data/2026/CVE-2026-128239.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/gpac/gpac","product":"gpac","vendor":"gpac","versions":[{"lessThanOrEqual":"26.07.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a non-existent group, crashing tools like MP4Box during chapter import for denial of service."}],"id":"CVE-2026-128239","lastModified":"2026-11-13T19:19:31.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128239","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T18:07:17.102783Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:11.657","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/gpac/gpac"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gpac/gpac/blob/v26.07.0/src/compositor/mpeg4_form.c#L620-L621"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gpac/gpac/commit/bc416b997622e43de65afab3bae9b7d05d72f2b0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gpac/gpac/issues/4029"},{"source":"disclosure@vulncheck.com","url":"https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/221/221_ab_apply_compositor_mpeg4_form_c_627.xmt"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gpac-through-26.07.0-null-pointer-dereference-via-mpeg-4-form-handlers"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/gpac/gpac","product":"gpac","vendor":"gpac","versions":[{"lessThanOrEqual":"26.07.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a non-existent group, crashing tools like MP4Box during chapter import for denial of service."}],"id":"CVE-2026-128239","lastModified":"2026-11-13T23:17:18.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128239","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T18:07:17.102783Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:11.657","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/gpac/gpac"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gpac/gpac/blob/v26.07.0/src/compositor/mpeg4_form.c#L620-L621"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gpac/gpac/commit/bc416b997622e43de65afab3bae9b7d05d72f2b0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gpac/gpac/issues/4029"},{"source":"disclosure@vulncheck.com","url":"https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/221/221_ab_apply_compositor_mpeg4_form_c_627.xmt"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gpac-through-26.07.0-null-pointer-dereference-via-mpeg-4-form-handlers"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/13/3"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-128242.json b/data/2026/CVE-2026-128242.json index 0c7f276533..6ddb484421 100644 --- a/data/2026/CVE-2026-128242.json +++ b/data/2026/CVE-2026-128242.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:cargo/actix-http","product":"actix-http","vendor":"actix","versions":[{"lessThan":"3.20.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:cargo/actix-web","product":"actix-web","vendor":"actix","versions":[{"lessThan":"4.18.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service."}],"id":"CVE-2026-128242","lastModified":"2026-11-13T10:18:12.180","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:12.180","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web"},{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web/blob/actix-http-v3.20.0/actix-http/src/encoding/decoder.rs#L239-L301"},{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280"},{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web/releases/tag/actix-http-v3.20.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web/releases/tag/actix-web-v4.18.2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web/security/advisories/GHSA-qph8-7859-gq2f"},{"source":"disclosure@vulncheck.com","url":"https://rustsec.org/advisories/RUSTSEC-2026-0448.html"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/actix-http-before-3.20.1-and-actix-web-before-4.18.2-decompression-bomb-dos-via-encoding-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:cargo/actix-http","product":"actix-http","vendor":"actix","versions":[{"lessThan":"3.20.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:cargo/actix-web","product":"actix-web","vendor":"actix","versions":[{"lessThan":"4.18.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form, Bytes or String extractors, or serve them to awc clients, causing denial of service."}],"id":"CVE-2026-128242","lastModified":"2026-11-13T23:17:18.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128242","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:20.372519Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:12.180","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web"},{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web/blob/actix-http-v3.20.0/actix-http/src/encoding/decoder.rs#L239-L301"},{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web/commit/0d0be61bd757027bfcecbc53df1b7a600f21ecd0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web/commit/41b54d23ea04f66758c15de7e4ab18325cd25280"},{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web/releases/tag/actix-http-v3.20.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web/releases/tag/actix-web-v4.18.2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/actix/actix-web/security/advisories/GHSA-qph8-7859-gq2f"},{"source":"disclosure@vulncheck.com","url":"https://rustsec.org/advisories/RUSTSEC-2026-0448.html"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/actix-http-before-3.20.1-and-actix-web-before-4.18.2-decompression-bomb-dos-via-encoding-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-128339.json b/data/2026/CVE-2026-128339.json index e0295e0ce3..ded6864dee 100644 --- a/data/2026/CVE-2026-128339.json +++ b/data/2026/CVE-2026-128339.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process."}],"id":"CVE-2026-128339","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.223","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L613-L632"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L895-L901"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/issues/3107"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/pull/3114"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-wh3v-83h4-rwwq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-merged-cell-range"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process."}],"id":"CVE-2026-128339","lastModified":"2026-11-13T23:17:18.497","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128339","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:17.732109Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:14.223","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L613-L632"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L895-L901"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/issues/3107"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/pull/3114"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-wh3v-83h4-rwwq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-merged-cell-range"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-128343.json b/data/2026/CVE-2026-128343.json index be91f5493f..0c50b91f9f 100644 --- a/data/2026/CVE-2026-128343.json +++ b/data/2026/CVE-2026-128343.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number."}],"id":"CVE-2026-128343","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.823","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L571-L580"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L886-L893"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/row-xform.js#L73-L77"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-3gm5-qxj8-89rr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-row-number"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-606"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number."}],"id":"CVE-2026-128343","lastModified":"2026-11-13T23:17:18.633","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128343","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:15.192985Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:14.823","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L571-L580"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L886-L893"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/row-xform.js#L73-L77"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-3gm5-qxj8-89rr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-row-number"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-606"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-128347.json b/data/2026/CVE-2026-128347.json index bc23592a94..dce1de0596 100644 --- a/data/2026/CVE-2026-128347.json +++ b/data/2026/CVE-2026-128347.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook."}],"id":"CVE-2026-128347","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.427","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L124-L130"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L230-L237"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f9m8-8qmf-qq29"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-arbitrary-file-read-via-workbookwriter-addimage-filename"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook."}],"id":"CVE-2026-128347","lastModified":"2026-11-13T23:17:18.783","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128347","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:12.560799Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:15.427","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L124-L130"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L230-L237"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f9m8-8qmf-qq29"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-arbitrary-file-read-via-workbookwriter-addimage-filename"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-129173.json b/data/2026/CVE-2026-129173.json new file mode 100644 index 0000000000..f82fdc027e --- /dev/null +++ b/data/2026/CVE-2026-129173.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:stirling-tools:stirling-pdf:*:*:*:*:*:*:*:*"],"modules":["Participant Details Endpoint"],"product":"Stirling-PDF","vendor":"Stirling-Tools","versions":[{"status":"affected","version":"3.0"},{"status":"affected","version":"3.1"},{"status":"affected","version":"3.2"},{"status":"affected","version":"3.3.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in Stirling-Tools Stirling-PDF up to 3.3.0. Affected is the function WorkflowParticipantController.getParticipantDetails of the file app/proprietary/src/main/java/stirling/software/proprietary/workflow/controller/WorkflowParticipantController.java of the component Participant Details Endpoint. Performing a manipulation results in insufficient session timeout value. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-129173","lastModified":"2026-11-13T23:17:19.070","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-13T23:17:18.920","references":[{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-129173"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1042368"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437206"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437206/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred"} diff --git a/data/2026/CVE-2026-129180.json b/data/2026/CVE-2026-129180.json new file mode 100644 index 0000000000..f9c4b2be7c --- /dev/null +++ b/data/2026/CVE-2026-129180.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:projectworlds:visitor_management_system:*:*:*:*:*:*:*:*"],"product":"Visitor Management System","vendor":"projectworlds","versions":[{"status":"affected","version":"1.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli_query of the file actionpage.php. This manipulation of the argument purpose causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used."}],"id":"CVE-2026-129180","lastModified":"2026-11-13T23:17:19.297","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-13T23:17:19.153","references":[{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-129180"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1042435"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437210"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437210/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}],"source":"cna@vuldb.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-45265.json b/data/2026/CVE-2026-45265.json index 7cfac8eb4d..59c72b02b9 100644 --- a/data/2026/CVE-2026-45265.json +++ b/data/2026/CVE-2026-45265.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a stack-based out-of-bounds write / stack-buffer-overflow in bacnet-stack when the server processes a malicious Atomic-Read-File request in record access mode. The bug is triggered on the real server side. A crafted request can set an excessively large RecordCount, which is later used as the loop bound for writing record data into a stack-allocated BACNET_ATOMIC_READ_FILE_DATA data structure. However, the stack object only has space for one fileData element. When the loop reaches i = 1, the code computes &data->fileData[1], which is already out of bounds, and the resulting invalid pointer is passed down to memmove(), causing a stack-buffer-overflow. This issue has been patched in versions 1.4.4 and 1.5.1."}],"id":"CVE-2026-45265","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:38.380","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1340"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-v3gx-mwrp-xvh5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a stack-based out-of-bounds write / stack-buffer-overflow in bacnet-stack when the server processes a malicious Atomic-Read-File request in record access mode. The bug is triggered on the real server side. A crafted request can set an excessively large RecordCount, which is later used as the loop bound for writing record data into a stack-allocated BACNET_ATOMIC_READ_FILE_DATA data structure. However, the stack object only has space for one fileData element. When the loop reaches i = 1, the code computes &data->fileData[1], which is already out of bounds, and the resulting invalid pointer is passed down to memmove(), causing a stack-buffer-overflow. This issue has been patched in versions 1.4.4 and 1.5.1."}],"id":"CVE-2026-45265","lastModified":"2026-11-13T23:17:19.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-45265","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:33:53.838763Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:38.380","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1340"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-v3gx-mwrp-xvh5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-47259.json b/data/2026/CVE-2026-47259.json index 8d58ee7076..791ff7019f 100644 --- a/data/2026/CVE-2026-47259.json +++ b/data/2026/CVE-2026-47259.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contains more than NC_MAX_RECIPIENTS valid BACnetDestination elements. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0."}],"id":"CVE-2026-47259","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:40.483","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1353"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9w9m-w7w5-rrv3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"},{"status":"affected","version":"< 1.6.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contains more than NC_MAX_RECIPIENTS valid BACnetDestination elements. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0."}],"id":"CVE-2026-47259","lastModified":"2026-11-13T23:17:19.583","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-47259","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:33:56.564485Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:40.483","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1353"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9w9m-w7w5-rrv3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-71519.json b/data/2026/CVE-2026-71519.json new file mode 100644 index 0000000000..51db6bcd77 --- /dev/null +++ b/data/2026/CVE-2026-71519.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/PrestaShop/PrestaShop","product":"PrestaShop","repo":"https://github.com/PrestaShop/PrestaShop","vendor":"PrestaShop","versions":[{"lessThan":"8.2.9","status":"affected","version":"0","versionType":"semver"},{"lessThan":"9.2.1","status":"affected","version":"9.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit the missing record-level shop ownership check in shopHasRight() and saveEntityFromXml() to read sensitive customer data such as password hashes and secure keys, and change a customer's email and password via create, update, and delete requests, resulting in account takeover."}],"id":"CVE-2026-71519","lastModified":"2026-11-13T23:17:19.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T23:17:19.700","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.9"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PrestaShop/PrestaShop/releases/tag/9.2.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hjwq-7qvv-qxj4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/prestashop-webservice-api-authorization-bypass-via-id-shop-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-71531.json b/data/2026/CVE-2026-71531.json new file mode 100644 index 0000000000..023b0f0491 --- /dev/null +++ b/data/2026/CVE-2026-71531.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/PrestaShop/PrestaShop","product":"PrestaShop","repo":"https://github.com/PrestaShop/PrestaShop","vendor":"PrestaShop","versions":[{"lessThan":"8.2.9","status":"affected","version":"0","versionType":"semver"},{"lessThan":"9.2.1","status":"affected","version":"9.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key restricted to one shop to act on data of every shop by submitting requests with id_shop=all or id_shop_group=N, which expand the shop context without validating the key's actual shop associations and cause shopHasRight() to evaluate the expanded set as a disjunction. Attackers can exploit this flaw via classes/webservice/WebserviceRequest.php to read, modify, or delete data belonging to shops they are not authorized for, including full customer records such as email addresses, secure_key, and password hashes across the installation."}],"id":"CVE-2026-71531","lastModified":"2026-11-13T23:17:19.853","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T23:17:19.853","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.9"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PrestaShop/PrestaShop/releases/tag/9.2.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3f36-4qv4-vfgh"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/prestashop-webservice-api-authorization-bypass-via-id-shop-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-95651.json b/data/2026/CVE-2026-95651.json index cd3ae68eb3..adcc7835b0 100644 --- a/data/2026/CVE-2026-95651.json +++ b/data/2026/CVE-2026-95651.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6500","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update vulnerability in the Linux Node Agent."}],"id":"CVE-2026-95651","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-10T11:16:43.903","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6500","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update vulnerability in the Linux Node Agent."}],"id":"CVE-2026-95651","lastModified":"2026-11-13T23:17:19.997","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95651","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:33:42.683194Z","version":"2.0.3"}}]},"published":"2026-11-10T11:16:43.903","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/state/sync.json b/state/sync.json index f9e87a54c5..0ab3fcc6e0 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1 +1 @@ -{"initial_complete":true,"last_run_counts":{"seen":4782,"skipped":39,"unchanged":4539,"written":204},"last_run_mode":"incremental","last_successful_end":"2026-11-13T22:42:47+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-13T22:48:29.347371+00:00"} +{"initial_complete":true,"last_run_counts":{"seen":4473,"skipped":39,"unchanged":4350,"written":84},"last_run_mode":"incremental","last_successful_end":"2026-11-14T00:42:50+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-14T00:50:04.463596+00:00"}