-
Notifications
You must be signed in to change notification settings - Fork 210
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- 3 new CVEs: CVE-2024-57252, CVE-2025-23202, CVE-2025-23205 - 3 updated CVEs: CVE-2025-23954, CVE-2025-23962, CVE-2025-23963
- Loading branch information
cvelistV5 Github Action
committed
Jan 17, 2025
1 parent
5e2a24e
commit ef6e5c5
Showing
8 changed files
with
441 additions
and
65 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "cveMetadata": { | ||
| "state": "PUBLISHED", | ||
| "cveId": "CVE-2024-57252", | ||
| "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", | ||
| "assignerShortName": "mitre", | ||
| "dateUpdated": "2025-01-17T20:17:18.159297", | ||
| "dateReserved": "2025-01-09T00:00:00", | ||
| "datePublished": "2025-01-17T00:00:00" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "providerMetadata": { | ||
| "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", | ||
| "shortName": "mitre", | ||
| "dateUpdated": "2025-01-17T20:17:18.159297" | ||
| }, | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "OtCMS <=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily." | ||
| } | ||
| ], | ||
| "affected": [ | ||
| { | ||
| "vendor": "n/a", | ||
| "product": "n/a", | ||
| "versions": [ | ||
| { | ||
| "version": "n/a", | ||
| "status": "affected" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "url": "https://github.com/J-0k3r/some/blob/main/ssrf.pdf" | ||
| }, | ||
| { | ||
| "url": "https://github.com/J-0k3r/CVE-2024-57252" | ||
| } | ||
| ], | ||
| "problemTypes": [ | ||
| { | ||
| "descriptions": [ | ||
| { | ||
| "type": "text", | ||
| "lang": "en", | ||
| "description": "n/a" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| "dataVersion": "5.1" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.1", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2025-23202", | ||
| "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "GitHub_M", | ||
| "dateReserved": "2025-01-13T17:15:41.050Z", | ||
| "datePublished": "2025-01-17T20:18:20.352Z", | ||
| "dateUpdated": "2025-01-17T20:18:20.352Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "title": "Improper Input Validation in Bible Module for ROBLOX", | ||
| "problemTypes": [ | ||
| { | ||
| "descriptions": [ | ||
| { | ||
| "cweId": "CWE-20", | ||
| "lang": "en", | ||
| "description": "CWE-20: Improper Input Validation", | ||
| "type": "CWE" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "metrics": [ | ||
| { | ||
| "cvssV4_0": { | ||
| "attackVector": "NETWORK", | ||
| "attackComplexity": "LOW", | ||
| "attackRequirements": "NONE", | ||
| "privilegesRequired": "NONE", | ||
| "userInteraction": "NONE", | ||
| "vulnConfidentialityImpact": "HIGH", | ||
| "vulnIntegrityImpact": "HIGH", | ||
| "vulnAvailabilityImpact": "HIGH", | ||
| "subConfidentialityImpact": "HIGH", | ||
| "subIntegrityImpact": "HIGH", | ||
| "subAvailabilityImpact": "HIGH", | ||
| "baseScore": 10, | ||
| "baseSeverity": "CRITICAL", | ||
| "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", | ||
| "version": "4.0" | ||
| } | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "name": "https://github.com/devycreates/Bible-Module/security/advisories/GHSA-cm7w-99v2-prrq", | ||
| "tags": [ | ||
| "x_refsource_CONFIRM" | ||
| ], | ||
| "url": "https://github.com/devycreates/Bible-Module/security/advisories/GHSA-cm7w-99v2-prrq" | ||
| }, | ||
| { | ||
| "name": "https://github.com/devycreates/Bible-Module/commit/5b783855fc3285be2da8639c97ac37af28f8c55a", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://github.com/devycreates/Bible-Module/commit/5b783855fc3285be2da8639c97ac37af28f8c55a" | ||
| } | ||
| ], | ||
| "affected": [ | ||
| { | ||
| "vendor": "devycreates", | ||
| "product": "Bible-Module", | ||
| "versions": [ | ||
| { | ||
| "version": "< 0.0.3", | ||
| "status": "affected" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", | ||
| "shortName": "GitHub_M", | ||
| "dateUpdated": "2025-01-17T20:18:20.352Z" | ||
| }, | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "Bible Module is a tool designed for ROBLOX developers to integrate Bible functionality into their games. The `FetchVerse` and `FetchPassage` functions in the Bible Module are susceptible to injection attacks due to the absence of input validation. This vulnerability could allow an attacker to manipulate the API request URLs, potentially leading to unauthorized access or data tampering. This issue has been addressed in version 0.0.3. All users are advised to upgrade. There are no known workarounds for this vulnerability." | ||
| } | ||
| ], | ||
| "source": { | ||
| "advisory": "GHSA-cm7w-99v2-prrq", | ||
| "discovery": "UNKNOWN" | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,108 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.1", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2025-23205", | ||
| "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "GitHub_M", | ||
| "dateReserved": "2025-01-13T17:15:41.050Z", | ||
| "datePublished": "2025-01-17T20:23:21.818Z", | ||
| "dateUpdated": "2025-01-17T20:23:21.818Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "title": "`frame-ancestors: self` grants all users access to formgrader in nbgrader", | ||
| "problemTypes": [ | ||
| { | ||
| "descriptions": [ | ||
| { | ||
| "cweId": "CWE-668", | ||
| "lang": "en", | ||
| "description": "CWE-668: Exposure of Resource to Wrong Sphere", | ||
| "type": "CWE" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "metrics": [ | ||
| { | ||
| "cvssV4_0": { | ||
| "attackVector": "NETWORK", | ||
| "attackComplexity": "LOW", | ||
| "attackRequirements": "NONE", | ||
| "privilegesRequired": "LOW", | ||
| "userInteraction": "PASSIVE", | ||
| "vulnConfidentialityImpact": "HIGH", | ||
| "vulnIntegrityImpact": "NONE", | ||
| "vulnAvailabilityImpact": "NONE", | ||
| "subConfidentialityImpact": "NONE", | ||
| "subIntegrityImpact": "NONE", | ||
| "subAvailabilityImpact": "NONE", | ||
| "baseScore": 6.9, | ||
| "baseSeverity": "MEDIUM", | ||
| "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", | ||
| "version": "4.0" | ||
| } | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "name": "https://github.com/jupyter/nbgrader/security/advisories/GHSA-fcr8-4r9f-r66m", | ||
| "tags": [ | ||
| "x_refsource_CONFIRM" | ||
| ], | ||
| "url": "https://github.com/jupyter/nbgrader/security/advisories/GHSA-fcr8-4r9f-r66m" | ||
| }, | ||
| { | ||
| "name": "https://github.com/jupyter/nbgrader/pull/1915", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://github.com/jupyter/nbgrader/pull/1915" | ||
| }, | ||
| { | ||
| "name": "https://github.com/jupyter/nbgrader/commit/73e137511ac1dc02e95790d4fd6d4d88dab42325", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://github.com/jupyter/nbgrader/commit/73e137511ac1dc02e95790d4fd6d4d88dab42325" | ||
| }, | ||
| { | ||
| "name": "https://jupyterhub.readthedocs.io/en/stable/explanation/websecurity.html#:~:text=frame-ancestors", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://jupyterhub.readthedocs.io/en/stable/explanation/websecurity.html#:~:text=frame-ancestors" | ||
| } | ||
| ], | ||
| "affected": [ | ||
| { | ||
| "vendor": "jupyter", | ||
| "product": "nbgrader", | ||
| "versions": [ | ||
| { | ||
| "version": "= 0.9.4", | ||
| "status": "affected" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", | ||
| "shortName": "GitHub_M", | ||
| "dateUpdated": "2025-01-17T20:23:21.818Z" | ||
| }, | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of `enable_subdomains = False`. #1915 disables a protection which would allow user Alice to craft a page embedding formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because Alice's page is on the same Origin as the formgrader iframe, Javasript on Alice's page has _full access_ to the contents of the page served by formgrader using Bob's credentials. This issue has been addressed in release 0.9.5 and all users are advised to upgrade. Users unable to upgrade may disable `frame-ancestors: self`, or enable per-user and per-service subdomains with `JupyterHub.enable_subdomains = True` (then even if embedding in an IFrame is allowed, the host page does not have access to the contents of the frame)." | ||
| } | ||
| ], | ||
| "source": { | ||
| "advisory": "GHSA-fcr8-4r9f-r66m", | ||
| "discovery": "UNKNOWN" | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.