Skip to content

Commit

Permalink
4 changes (4 new | 0 updated):
Browse files Browse the repository at this point in the history 
      - 4 new CVEs:  CVE-2024-56202, CVE-2024-7872, CVE-2025-1383, CVE-2025-1666
      - 0 updated CVEs:
  • Loading branch information
cvelistV5 Github Action committed Mar 6, 2025
1 parent e30ff67 commit bc245d9
Show file tree
Hide file tree
Showing 4 changed files with 406 additions and 0 deletions.
100 changes: 100 additions & 0 deletions cves/2024/56xxx/CVE-2024-56202.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,100 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"cveMetadata": {
"cveId": "CVE-2024-56202",
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"state": "PUBLISHED",
"assignerShortName": "apache",
"dateReserved": "2024-12-18T18:32:31.122Z",
"datePublished": "2025-03-06T11:09:11.632Z",
"dateUpdated": "2025-03-06T11:09:11.632Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Traffic Server",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "9.2.8",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.0.3",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "David Carlin"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Expected Behavior Violation vulnerability in Apache Traffic Server.</p><p>This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3.</p><p>Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue.</p>"
}
],
"value": "Expected Behavior Violation vulnerability in Apache Traffic Server.\n\nThis issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3.\n\nUsers are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-440",
"description": "CWE-440 Expected Behavior Violation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache",
"dateUpdated": "2025-03-06T11:09:11.632Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/btofzws2yqskk2n7f01r3l1819x01023"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Traffic Server: Expect header field can unreasonably retain resource",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
}
}
121 changes: 121 additions & 0 deletions cves/2024/7xxx/CVE-2024-7872.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,121 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"cveMetadata": {
"cveId": "CVE-2024-7872",
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"state": "PUBLISHED",
"assignerShortName": "TR-CERT",
"dateReserved": "2024-08-16T08:29:11.091Z",
"datePublished": "2025-03-06T11:14:35.964Z",
"dateUpdated": "2025-03-06T11:14:35.964Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Extreme XDS",
"vendor": "ExtremePACS",
"versions": [
{
"lessThan": "3933",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mustafa Anil YILDIRIM"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in ExtremePACS Extreme XDS allows Retrieve Embedded Sensitive Data.<p>This issue affects Extreme XDS: before 3933.</p>"
}
],
"value": "Insertion of Sensitive Information Into Sent Data vulnerability in ExtremePACS Extreme XDS allows Retrieve Embedded Sensitive Data.This issue affects Extreme XDS: before 3933."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT",
"dateUpdated": "2025-03-06T11:14:35.964Z"
},
"references": [
{
"url": "https://www.usom.gov.tr/bildirim/tr-25-0057"
}
],
"source": {
"advisory": "TR-25-0057",
"defect": [
"TR-25-0057"
],
"discovery": "UNKNOWN"
},
"title": "Sensetive Data Exposure in ExtremePACS' Extreme XDS",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
}
}
94 changes: 94 additions & 0 deletions cves/2025/1xxx/CVE-2025-1383.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,94 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"cveMetadata": {
"cveId": "CVE-2025-1383",
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"state": "PUBLISHED",
"assignerShortName": "Wordfence",
"dateReserved": "2025-02-16T23:08:11.128Z",
"datePublished": "2025-03-06T11:11:01.134Z",
"dateUpdated": "2025-03-06T11:11:01.134Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence",
"dateUpdated": "2025-03-06T11:11:01.134Z"
},
"affected": [
{
"vendor": "eteubert",
"product": "Podlove Podcast Publisher",
"versions": [
{
"version": "*",
"status": "affected",
"lessThanOrEqual": "4.2.2",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. This is due to missing or incorrect nonce validation on the ajax_transcript_delete() function. This makes it possible for unauthenticated attackers to delete arbitrary episode transcripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
}
],
"title": "Podlove Podcast Publisher <= 4.2.2 - Cross-Site Request Forgery via ajax_transcript_delete Function",
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/00a95ae7-3c58-4e5e-aaef-c04d1dacf27f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.2.0/lib/modules/transcripts/transcripts.php#L223"
},
{
"url": "https://wordpress.org/plugins/podlove-podcasting-plugin-for-wordpress/#developers"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3246867/"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"cweId": "CWE-352",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abbas Mamoun"
}
],
"timeline": [
{
"time": "2025-03-05T21:31:57.000+00:00",
"lang": "en",
"value": "Disclosed"
}
]
}
}
}
Loading

0 comments on commit bc245d9

Please sign in to comment.