From 4c8561d8e89da229d4c3e5b1727ba473e865c3db Mon Sep 17 00:00:00 2001 From: cvelistV5 Github Action Date: Tue, 11 Feb 2025 15:09:34 +0000 Subject: [PATCH] 10 changes (1 new | 9 updated): - 1 new CVEs: CVE-2024-33659 - 9 updated CVEs: CVE-2023-0156, CVE-2023-37482, CVE-2024-27859, CVE-2024-54658, CVE-2025-1160, CVE-2025-1180, CVE-2025-1231, CVE-2025-24200, CVE-2025-26490 --- cves/2023/0xxx/CVE-2023-0156.json | 62 +++++++++++++++- cves/2023/37xxx/CVE-2023-37482.json | 38 +++++++++- cves/2024/27xxx/CVE-2024-27859.json | 66 ++++++++++++++++- cves/2024/33xxx/CVE-2024-33659.json | 109 ++++++++++++++++++++++++++++ cves/2024/54xxx/CVE-2024-54658.json | 66 ++++++++++++++++- cves/2025/1xxx/CVE-2025-1160.json | 66 ++++++++++++++++- cves/2025/1xxx/CVE-2025-1180.json | 52 ++++++++++++- cves/2025/1xxx/CVE-2025-1231.json | 54 +++++++++++++- cves/2025/24xxx/CVE-2025-24200.json | 62 +++++++++++++++- cves/2025/26xxx/CVE-2025-26490.json | 46 +++++++++++- 10 files changed, 605 insertions(+), 16 deletions(-) create mode 100644 cves/2024/33xxx/CVE-2024-33659.json diff --git a/cves/2023/0xxx/CVE-2023-0156.json b/cves/2023/0xxx/CVE-2023-0156.json index cd70bb46b2ac..cb83f25bcefa 100644 --- a/cves/2023/0xxx/CVE-2023-0156.json +++ b/cves/2023/0xxx/CVE-2023-0156.json @@ -8,7 +8,7 @@ "assignerShortName": "WPScan", "dateReserved": "2023-01-10T12:05:57.391Z", "datePublished": "2023-04-10T13:17:59.914Z", - "dateUpdated": "2024-08-02T05:02:43.743Z" + "dateUpdated": "2025-02-11T15:08:29.605Z" }, "containers": { "cna": { @@ -99,6 +99,66 @@ ] } ] + }, + { + "problemTypes": [ + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-22", + "lang": "en", + "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "scope": "UNCHANGED", + "version": "3.1", + "baseScore": 4.9, + "attackVector": "NETWORK", + "baseSeverity": "MEDIUM", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", + "integrityImpact": "NONE", + "userInteraction": "NONE", + "attackComplexity": "LOW", + "availabilityImpact": "NONE", + "privilegesRequired": "HIGH", + "confidentialityImpact": "HIGH" + } + }, + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2025-02-11T15:03:31.570499Z", + "id": "CVE-2023-0156", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2025-02-11T15:08:29.605Z" + } } ] } diff --git a/cves/2023/37xxx/CVE-2023-37482.json b/cves/2023/37xxx/CVE-2023-37482.json index a176ee45ddcf..b05219af26be 100644 --- a/cves/2023/37xxx/CVE-2023-37482.json +++ b/cves/2023/37xxx/CVE-2023-37482.json @@ -8,7 +8,7 @@ "assignerShortName": "siemens", "dateReserved": "2023-07-06T14:15:23.961Z", "datePublished": "2025-02-11T10:26:27.720Z", - "dateUpdated": "2025-02-11T10:26:27.720Z" + "dateUpdated": "2025-02-11T14:59:05.377Z" }, "containers": { "cna": { @@ -1399,6 +1399,40 @@ "url": "https://cert-portal.siemens.com/productcert/html/ssa-195895.html" } ] - } + }, + "adp": [ + { + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2025-02-11T14:58:41.814673Z", + "id": "CVE-2023-37482", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2025-02-11T14:59:05.377Z" + } + } + ] } } \ No newline at end of file diff --git a/cves/2024/27xxx/CVE-2024-27859.json b/cves/2024/27xxx/CVE-2024-27859.json index c344894b8b35..9e15fc4da0cd 100644 --- a/cves/2024/27xxx/CVE-2024-27859.json +++ b/cves/2024/27xxx/CVE-2024-27859.json @@ -8,7 +8,7 @@ "assignerShortName": "apple", "dateReserved": "2024-02-26T15:32:28.540Z", "datePublished": "2025-02-10T18:09:24.906Z", - "dateUpdated": "2025-02-10T18:09:24.906Z" + "dateUpdated": "2025-02-11T15:00:27.392Z" }, "containers": { "cna": { @@ -112,6 +112,68 @@ "shortName": "apple", "dateUpdated": "2025-02-10T18:09:24.906Z" } - } + }, + "adp": [ + { + "problemTypes": [ + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-94", + "lang": "en", + "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "scope": "UNCHANGED", + "version": "3.1", + "baseScore": 8.8, + "attackVector": "NETWORK", + "baseSeverity": "HIGH", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "integrityImpact": "HIGH", + "userInteraction": "REQUIRED", + "attackComplexity": "LOW", + "availabilityImpact": "HIGH", + "privilegesRequired": "NONE", + "confidentialityImpact": "HIGH" + } + }, + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2025-02-11T14:59:20.982393Z", + "id": "CVE-2024-27859", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2025-02-11T15:00:27.392Z" + } + } + ] } } \ No newline at end of file diff --git a/cves/2024/33xxx/CVE-2024-33659.json b/cves/2024/33xxx/CVE-2024-33659.json new file mode 100644 index 000000000000..b3d389141b75 --- /dev/null +++ b/cves/2024/33xxx/CVE-2024-33659.json @@ -0,0 +1,109 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.1", + "cveMetadata": { + "cveId": "CVE-2024-33659", + "assignerOrgId": "7e9044f1-7f56-4c38-8864-c0c7302263d6", + "state": "PUBLISHED", + "assignerShortName": "AMI", + "dateReserved": "2024-04-25T13:29:51.809Z", + "datePublished": "2025-02-11T15:00:11.196Z", + "dateUpdated": "2025-02-11T15:00:11.196Z" + }, + "containers": { + "cna": { + "affected": [ + { + "defaultStatus": "unaffected", + "product": "AptioV", + "vendor": "AMI", + "versions": [ + { + "lessThanOrEqual": "BKS_5.38", + "status": "affected", + "version": "BKS_5.0", + "versionType": "Custom" + } + ] + } + ], + "datePublic": "2025-02-11T15:00:00.000Z", + "descriptions": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker. Successful exploitation of these vulnerabilities may lead to overwriting arbitrary memory and execute arbitrary code at SMM level, also impacting Confidentiality, Integrity, and Availability." + } + ], + "value": "AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker. Successful exploitation of these vulnerabilities may lead to overwriting arbitrary memory and execute arbitrary code at SMM level, also impacting Confidentiality, Integrity, and Availability." + } + ], + "metrics": [ + { + "cvssV4_0": { + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "attackComplexity": "HIGH", + "attackRequirements": "NONE", + "attackVector": "LOCAL", + "baseScore": 5.7, + "baseSeverity": "MEDIUM", + "privilegesRequired": "HIGH", + "providerUrgency": "NOT_DEFINED", + "subAvailabilityImpact": "LOW", + "subConfidentialityImpact": "LOW", + "subIntegrityImpact": "LOW", + "userInteraction": "NONE", + "valueDensity": "NOT_DEFINED", + "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L", + "version": "4.0", + "vulnAvailabilityImpact": "HIGH", + "vulnConfidentialityImpact": "LOW", + "vulnIntegrityImpact": "HIGH", + "vulnerabilityResponseEffort": "NOT_DEFINED" + }, + "format": "CVSS", + "scenarios": [ + { + "lang": "en", + "value": "GENERAL" + } + ] + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-20", + "description": "CWE-20 Improper Input Validation", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "providerMetadata": { + "orgId": "7e9044f1-7f56-4c38-8864-c0c7302263d6", + "shortName": "AMI", + "dateUpdated": "2025-02-11T15:00:11.196Z" + }, + "references": [ + { + "url": "https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2025/AMI-SA-2025002.pdf" + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "title": "BiosGuard Buffer Overflow and TOCTOU Vulnerability", + "x_generator": { + "engine": "Vulnogram 0.2.0" + } + } + } +} \ No newline at end of file diff --git a/cves/2024/54xxx/CVE-2024-54658.json b/cves/2024/54xxx/CVE-2024-54658.json index 8ebc336a0a5a..ba07a39dbc66 100644 --- a/cves/2024/54xxx/CVE-2024-54658.json +++ b/cves/2024/54xxx/CVE-2024-54658.json @@ -8,7 +8,7 @@ "assignerShortName": "apple", "dateReserved": "2024-12-03T22:50:35.544Z", "datePublished": "2025-02-10T18:09:24.079Z", - "dateUpdated": "2025-02-10T18:09:24.079Z" + "dateUpdated": "2025-02-11T15:02:32.093Z" }, "containers": { "cna": { @@ -127,6 +127,68 @@ "shortName": "apple", "dateUpdated": "2025-02-10T18:09:24.079Z" } - } + }, + "adp": [ + { + "problemTypes": [ + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-770", + "lang": "en", + "description": "CWE-770 Allocation of Resources Without Limits or Throttling" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "scope": "UNCHANGED", + "version": "3.1", + "baseScore": 6.5, + "attackVector": "NETWORK", + "baseSeverity": "MEDIUM", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "integrityImpact": "NONE", + "userInteraction": "REQUIRED", + "attackComplexity": "LOW", + "availabilityImpact": "HIGH", + "privilegesRequired": "NONE", + "confidentialityImpact": "NONE" + } + }, + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2025-02-11T15:01:02.733307Z", + "id": "CVE-2024-54658", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2025-02-11T15:02:32.093Z" + } + } + ] } } \ No newline at end of file diff --git a/cves/2025/1xxx/CVE-2025-1160.json b/cves/2025/1xxx/CVE-2025-1160.json index 3159b6ec2141..12d80832abfe 100644 --- a/cves/2025/1xxx/CVE-2025-1160.json +++ b/cves/2025/1xxx/CVE-2025-1160.json @@ -8,7 +8,7 @@ "assignerShortName": "VulDB", "dateReserved": "2025-02-10T08:04:17.261Z", "datePublished": "2025-02-10T22:31:04.690Z", - "dateUpdated": "2025-02-10T22:31:04.690Z" + "dateUpdated": "2025-02-11T14:54:53.659Z" }, "containers": { "cna": { @@ -146,6 +146,68 @@ ] } ] - } + }, + "adp": [ + { + "problemTypes": [ + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-1392", + "lang": "en", + "description": "CWE-1392 Use of Default Credentials" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "scope": "UNCHANGED", + "version": "3.1", + "baseScore": 7.3, + "attackVector": "NETWORK", + "baseSeverity": "HIGH", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "integrityImpact": "LOW", + "userInteraction": "NONE", + "attackComplexity": "LOW", + "availabilityImpact": "LOW", + "privilegesRequired": "NONE", + "confidentialityImpact": "LOW" + } + }, + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2025-02-11T14:53:11.215673Z", + "id": "CVE-2025-1160", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2025-02-11T14:54:53.659Z" + } + } + ] } } \ No newline at end of file diff --git a/cves/2025/1xxx/CVE-2025-1180.json b/cves/2025/1xxx/CVE-2025-1180.json index 4b3aaf289cd6..36d461d47c06 100644 --- a/cves/2025/1xxx/CVE-2025-1180.json +++ b/cves/2025/1xxx/CVE-2025-1180.json @@ -8,7 +8,7 @@ "assignerShortName": "VulDB", "dateReserved": "2025-02-10T10:58:44.930Z", "datePublished": "2025-02-11T07:31:06.853Z", - "dateUpdated": "2025-02-11T07:31:06.853Z" + "dateUpdated": "2025-02-11T14:55:02.649Z" }, "containers": { "cna": { @@ -155,6 +155,54 @@ ] } ] - } + }, + "adp": [ + { + "references": [ + { + "url": "https://vuldb.com/?submit.495381", + "tags": [ + "exploit" + ] + }, + { + "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32642", + "tags": [ + "exploit" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2025-02-11T14:54:30.440591Z", + "id": "CVE-2025-1180", + "options": [ + { + "Exploitation": "poc" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2025-02-11T14:55:02.649Z" + } + } + ] } } \ No newline at end of file diff --git a/cves/2025/1xxx/CVE-2025-1231.json b/cves/2025/1xxx/CVE-2025-1231.json index 37e78f912096..ab9b0f2f4c73 100644 --- a/cves/2025/1xxx/CVE-2025-1231.json +++ b/cves/2025/1xxx/CVE-2025-1231.json @@ -8,7 +8,7 @@ "assignerShortName": "DEVOLUTIONS", "dateReserved": "2025-02-11T13:34:41.146Z", "datePublished": "2025-02-11T14:05:38.399Z", - "dateUpdated": "2025-02-11T14:05:38.399Z" + "dateUpdated": "2025-02-11T14:56:16.812Z" }, "containers": { "cna": { @@ -71,6 +71,56 @@ "x_generator": { "engine": "Vulnogram 0.2.0" } - } + }, + "adp": [ + { + "metrics": [ + { + "cvssV3_1": { + "scope": "UNCHANGED", + "version": "3.1", + "baseScore": 5.4, + "attackVector": "NETWORK", + "baseSeverity": "MEDIUM", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", + "integrityImpact": "LOW", + "userInteraction": "NONE", + "attackComplexity": "LOW", + "availabilityImpact": "NONE", + "privilegesRequired": "LOW", + "confidentialityImpact": "LOW" + } + }, + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2025-02-11T14:55:36.446797Z", + "id": "CVE-2025-1231", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2025-02-11T14:56:16.812Z" + } + } + ] } } \ No newline at end of file diff --git a/cves/2025/24xxx/CVE-2025-24200.json b/cves/2025/24xxx/CVE-2025-24200.json index e3f24833d43d..ae542816eb72 100644 --- a/cves/2025/24xxx/CVE-2025-24200.json +++ b/cves/2025/24xxx/CVE-2025-24200.json @@ -8,7 +8,7 @@ "assignerShortName": "apple", "dateReserved": "2025-01-17T00:00:44.999Z", "datePublished": "2025-02-10T19:04:45.242Z", - "dateUpdated": "2025-02-11T06:03:30.230Z" + "dateUpdated": "2025-02-11T14:58:32.316Z" }, "containers": { "cna": { @@ -84,6 +84,66 @@ "shortName": "CVE", "dateUpdated": "2025-02-11T06:03:30.230Z" } + }, + { + "problemTypes": [ + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-863", + "lang": "en", + "description": "CWE-863 Incorrect Authorization" + } + ] + } + ], + "metrics": [ + { + "cvssV3_1": { + "scope": "UNCHANGED", + "version": "3.1", + "baseScore": 7.5, + "attackVector": "NETWORK", + "baseSeverity": "HIGH", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", + "integrityImpact": "HIGH", + "userInteraction": "NONE", + "attackComplexity": "LOW", + "availabilityImpact": "NONE", + "privilegesRequired": "NONE", + "confidentialityImpact": "NONE" + } + }, + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2025-02-11T14:57:12.529480Z", + "id": "CVE-2025-24200", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "yes" + }, + { + "Technical Impact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2025-02-11T14:58:32.316Z" + } } ] } diff --git a/cves/2025/26xxx/CVE-2025-26490.json b/cves/2025/26xxx/CVE-2025-26490.json index 9083cb036499..472e3e728f2a 100644 --- a/cves/2025/26xxx/CVE-2025-26490.json +++ b/cves/2025/26xxx/CVE-2025-26490.json @@ -8,7 +8,7 @@ "assignerShortName": "siemens", "dateReserved": "2025-02-11T08:34:48.167Z", "datePublished": "2025-02-11T10:29:19.643Z", - "dateUpdated": "2025-02-11T10:29:19.643Z" + "dateUpdated": "2025-02-11T14:59:43.850Z" }, "containers": { "cna": { @@ -65,6 +65,48 @@ "url": "https://cert-portal.siemens.com/productcert/html/ssa-246355.html" } ] - } + }, + "adp": [ + { + "references": [ + { + "url": "https://help.salesforce.com/s/articleView?id=000390611&type=1", + "tags": [ + "third-party-advisory" + ] + } + ], + "metrics": [ + { + "other": { + "type": "ssvc", + "content": { + "timestamp": "2025-02-11T14:58:45.842844Z", + "id": "CVE-2025-26490", + "options": [ + { + "Exploitation": "none" + }, + { + "Automatable": "no" + }, + { + "Technical Impact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + } + ], + "title": "CISA ADP Vulnrichment", + "providerMetadata": { + "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "shortName": "CISA-ADP", + "dateUpdated": "2025-02-11T14:59:43.850Z" + } + } + ] } } \ No newline at end of file