Skip to content

Commit f9e21f6

Browse files
cad-safe-botcad-safe-bot
committed
Auto-Update: 2025-03-16T15:00:20.111600+00:00
1 parent 293e5b4 commit f9e21f6

File tree

6 files changed

+457
-10
lines changed

6 files changed

+457
-10
lines changed

‎CVE-2025/CVE-2025-12xx/CVE-2025-1211.json

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22
"id": "CVE-2025-1211",
33
"sourceIdentifier": "[email protected]",
44
"published": "2025-02-11T05:15:14.013",
5-
"lastModified": "2025-02-11T16:15:50.660",
5+
"lastModified": "2025-03-16T13:15:36.813",
66
"vulnStatus": "Awaiting Analysis",
77
"cveTags": [],
88
"descriptions": [
99
{
1010
"lang": "en",
11-
"value": "Versions of the package hackney from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://[email protected]/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/. \rThis vulnerability can be exploited when users rely on the URL function for host checking."
11+
"value": "Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://[email protected]/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/. \rThis vulnerability can be exploited when users rely on the URL function for host checking."
1212
},
1313
{
1414
"lang": "es",
@@ -110,6 +110,10 @@
110110
"url": "https://gist.github.com/snoopysecurity/996de09ec0cfd0ebdcfdda8ff515deb1",
111111
"source": "[email protected]"
112112
},
113+
{
114+
"url": "https://github.com/benoitc/hackney/commit/9594ce58fabd32cd897fc28fae937694515a3d4a",
115+
"source": "[email protected]"
116+
},
113117
{
114118
"url": "https://security.snyk.io/vuln/SNYK-HEX-HACKNEY-6516131",
115119
"source": "[email protected]"

‎CVE-2025/CVE-2025-23xx/CVE-2025-2338.json

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
{
2+
"id": "CVE-2025-2338",
3+
"sourceIdentifier": "[email protected]",
4+
"published": "2025-03-16T13:15:37.827",
5+
"lastModified": "2025-03-16T13:15:37.827",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "A vulnerability, which was classified as critical, was found in tbeu matio 1.5.28. Affected is the function strdup_vprintf of the file src/io.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV40": [
16+
{
17+
"source": "[email protected]",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "4.0",
21+
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
22+
"baseScore": 5.3,
23+
"baseSeverity": "MEDIUM",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"attackRequirements": "NONE",
27+
"privilegesRequired": "NONE",
28+
"userInteraction": "PASSIVE",
29+
"vulnConfidentialityImpact": "LOW",
30+
"vulnIntegrityImpact": "LOW",
31+
"vulnAvailabilityImpact": "LOW",
32+
"subConfidentialityImpact": "NONE",
33+
"subIntegrityImpact": "NONE",
34+
"subAvailabilityImpact": "NONE",
35+
"exploitMaturity": "NOT_DEFINED",
36+
"confidentialityRequirement": "NOT_DEFINED",
37+
"integrityRequirement": "NOT_DEFINED",
38+
"availabilityRequirement": "NOT_DEFINED",
39+
"modifiedAttackVector": "NOT_DEFINED",
40+
"modifiedAttackComplexity": "NOT_DEFINED",
41+
"modifiedAttackRequirements": "NOT_DEFINED",
42+
"modifiedPrivilegesRequired": "NOT_DEFINED",
43+
"modifiedUserInteraction": "NOT_DEFINED",
44+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
45+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
46+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
47+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
48+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
49+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
50+
"Safety": "NOT_DEFINED",
51+
"Automatable": "NOT_DEFINED",
52+
"Recovery": "NOT_DEFINED",
53+
"valueDensity": "NOT_DEFINED",
54+
"vulnerabilityResponseEffort": "NOT_DEFINED",
55+
"providerUrgency": "NOT_DEFINED"
56+
}
57+
}
58+
],
59+
"cvssMetricV31": [
60+
{
61+
"source": "[email protected]",
62+
"type": "Primary",
63+
"cvssData": {
64+
"version": "3.1",
65+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
66+
"baseScore": 6.3,
67+
"baseSeverity": "MEDIUM",
68+
"attackVector": "NETWORK",
69+
"attackComplexity": "LOW",
70+
"privilegesRequired": "NONE",
71+
"userInteraction": "REQUIRED",
72+
"scope": "UNCHANGED",
73+
"confidentialityImpact": "LOW",
74+
"integrityImpact": "LOW",
75+
"availabilityImpact": "LOW"
76+
},
77+
"exploitabilityScore": 2.8,
78+
"impactScore": 3.4
79+
}
80+
],
81+
"cvssMetricV2": [
82+
{
83+
"source": "[email protected]",
84+
"type": "Secondary",
85+
"cvssData": {
86+
"version": "2.0",
87+
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
88+
"baseScore": 7.5,
89+
"accessVector": "NETWORK",
90+
"accessComplexity": "LOW",
91+
"authentication": "NONE",
92+
"confidentialityImpact": "PARTIAL",
93+
"integrityImpact": "PARTIAL",
94+
"availabilityImpact": "PARTIAL"
95+
},
96+
"baseSeverity": "HIGH",
97+
"exploitabilityScore": 10.0,
98+
"impactScore": 6.4,
99+
"acInsufInfo": false,
100+
"obtainAllPrivilege": false,
101+
"obtainUserPrivilege": false,
102+
"obtainOtherPrivilege": false,
103+
"userInteractionRequired": false
104+
}
105+
]
106+
},
107+
"weaknesses": [
108+
{
109+
"source": "[email protected]",
110+
"type": "Primary",
111+
"description": [
112+
{
113+
"lang": "en",
114+
"value": "CWE-119"
115+
},
116+
{
117+
"lang": "en",
118+
"value": "CWE-122"
119+
}
120+
]
121+
}
122+
],
123+
"references": [
124+
{
125+
"url": "https://github.com/tbeu/matio/issues/269",
126+
"source": "[email protected]"
127+
},
128+
{
129+
"url": "https://github.com/tbeu/matio/issues/269#issue-2883920922",
130+
"source": "[email protected]"
131+
},
132+
{
133+
"url": "https://vuldb.com/?ctiid.299802",
134+
"source": "[email protected]"
135+
},
136+
{
137+
"url": "https://vuldb.com/?id.299802",
138+
"source": "[email protected]"
139+
},
140+
{
141+
"url": "https://vuldb.com/?submit.510781",
142+
"source": "[email protected]"
143+
}
144+
]
145+
}

‎CVE-2025/CVE-2025-23xx/CVE-2025-2339.json

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
{
2+
"id": "CVE-2025-2339",
3+
"sourceIdentifier": "[email protected]",
4+
"published": "2025-03-16T13:15:38.003",
5+
"lastModified": "2025-03-16T13:15:38.003",
6+
"vulnStatus": "Received",
7+
"cveTags": [
8+
{
9+
"sourceIdentifier": "[email protected]",
10+
"tags": [
11+
"unsupported-when-assigned"
12+
]
13+
}
14+
],
15+
"descriptions": [
16+
{
17+
"lang": "en",
18+
"value": "A vulnerability was found in otale Tale Blog 2.0.5. It has been classified as problematic. This affects an unknown part of the file /%61dmin/api/logs. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer."
19+
}
20+
],
21+
"metrics": {
22+
"cvssMetricV40": [
23+
{
24+
"source": "[email protected]",
25+
"type": "Secondary",
26+
"cvssData": {
27+
"version": "4.0",
28+
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
29+
"baseScore": 6.9,
30+
"baseSeverity": "MEDIUM",
31+
"attackVector": "NETWORK",
32+
"attackComplexity": "LOW",
33+
"attackRequirements": "NONE",
34+
"privilegesRequired": "NONE",
35+
"userInteraction": "NONE",
36+
"vulnConfidentialityImpact": "LOW",
37+
"vulnIntegrityImpact": "NONE",
38+
"vulnAvailabilityImpact": "NONE",
39+
"subConfidentialityImpact": "NONE",
40+
"subIntegrityImpact": "NONE",
41+
"subAvailabilityImpact": "NONE",
42+
"exploitMaturity": "NOT_DEFINED",
43+
"confidentialityRequirement": "NOT_DEFINED",
44+
"integrityRequirement": "NOT_DEFINED",
45+
"availabilityRequirement": "NOT_DEFINED",
46+
"modifiedAttackVector": "NOT_DEFINED",
47+
"modifiedAttackComplexity": "NOT_DEFINED",
48+
"modifiedAttackRequirements": "NOT_DEFINED",
49+
"modifiedPrivilegesRequired": "NOT_DEFINED",
50+
"modifiedUserInteraction": "NOT_DEFINED",
51+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
52+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
53+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
54+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
55+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
56+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
57+
"Safety": "NOT_DEFINED",
58+
"Automatable": "NOT_DEFINED",
59+
"Recovery": "NOT_DEFINED",
60+
"valueDensity": "NOT_DEFINED",
61+
"vulnerabilityResponseEffort": "NOT_DEFINED",
62+
"providerUrgency": "NOT_DEFINED"
63+
}
64+
}
65+
],
66+
"cvssMetricV31": [
67+
{
68+
"source": "[email protected]",
69+
"type": "Primary",
70+
"cvssData": {
71+
"version": "3.1",
72+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
73+
"baseScore": 5.3,
74+
"baseSeverity": "MEDIUM",
75+
"attackVector": "NETWORK",
76+
"attackComplexity": "LOW",
77+
"privilegesRequired": "NONE",
78+
"userInteraction": "NONE",
79+
"scope": "UNCHANGED",
80+
"confidentialityImpact": "LOW",
81+
"integrityImpact": "NONE",
82+
"availabilityImpact": "NONE"
83+
},
84+
"exploitabilityScore": 3.9,
85+
"impactScore": 1.4
86+
}
87+
],
88+
"cvssMetricV2": [
89+
{
90+
"source": "[email protected]",
91+
"type": "Secondary",
92+
"cvssData": {
93+
"version": "2.0",
94+
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
95+
"baseScore": 5.0,
96+
"accessVector": "NETWORK",
97+
"accessComplexity": "LOW",
98+
"authentication": "NONE",
99+
"confidentialityImpact": "PARTIAL",
100+
"integrityImpact": "NONE",
101+
"availabilityImpact": "NONE"
102+
},
103+
"baseSeverity": "MEDIUM",
104+
"exploitabilityScore": 10.0,
105+
"impactScore": 2.9,
106+
"acInsufInfo": false,
107+
"obtainAllPrivilege": false,
108+
"obtainUserPrivilege": false,
109+
"obtainOtherPrivilege": false,
110+
"userInteractionRequired": false
111+
}
112+
]
113+
},
114+
"weaknesses": [
115+
{
116+
"source": "[email protected]",
117+
"type": "Primary",
118+
"description": [
119+
{
120+
"lang": "en",
121+
"value": "CWE-287"
122+
}
123+
]
124+
}
125+
],
126+
"references": [
127+
{
128+
"url": "https://github.com/qkdjksfkeg/cve_article/blob/main/Tale/Unauthorized.md",
129+
"source": "[email protected]"
130+
},
131+
{
132+
"url": "https://vuldb.com/?ctiid.299805",
133+
"source": "[email protected]"
134+
},
135+
{
136+
"url": "https://vuldb.com/?id.299805",
137+
"source": "[email protected]"
138+
},
139+
{
140+
"url": "https://vuldb.com/?submit.511578",
141+
"source": "[email protected]"
142+
}
143+
]
144+
}

0 commit comments

Comments
 (0)