🤖 NVD update at 2025-01-18T10:45:04+0000

eslerm · Jan 18, 2025 · 65b57a6 · 65b57a6
1 parent 4565cff
commit 65b57a6
Show file tree

Hide file tree

Showing 5 changed files with 273 additions and 8 deletions.
diff --git a/2024/CVE-2024-13184.json b/2024/CVE-2024-13184.json
@@ -0,0 +1,68 @@
+{
+    "id": "CVE-2024-13184",
+    "sourceIdentifier": "[email protected]",
+    "published": "2025-01-18T09:15:06.937",
+    "lastModified": "2025-01-18T09:15:06.937",
+    "vulnStatus": "Received",
+    "cveTags": [],
+    "descriptions": [
+        {
+            "lang": "en",
+            "value": "The The Ultimate WordPress Toolkit \u2013 WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions up to, and including, 3.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
+        }
+    ],
+    "metrics": {
+        "cvssMetricV31": [
+            {
+                "source": "[email protected]",
+                "type": "Primary",
+                "cvssData": {
+                    "version": "3.1",
+                    "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+                    "baseScore": 7.5,
+                    "baseSeverity": "HIGH",
+                    "attackVector": "NETWORK",
+                    "attackComplexity": "LOW",
+                    "privilegesRequired": "NONE",
+                    "userInteraction": "NONE",
+                    "scope": "UNCHANGED",
+                    "confidentialityImpact": "HIGH",
+                    "integrityImpact": "NONE",
+                    "availabilityImpact": "NONE"
+                },
+                "exploitabilityScore": 3.9,
+                "impactScore": 3.6
+            }
+        ]
+    },
+    "weaknesses": [
+        {
+            "source": "[email protected]",
+            "type": "Primary",
+            "description": [
+                {
+                    "lang": "en",
+                    "value": "CWE-89"
+                }
+            ]
+        }
+    ],
+    "references": [
+        {
+            "url": "https://plugins.trac.wordpress.org/browser/wpextended/trunk/includes/modules/core_extensions/wpext_limit_login_attempts/wpext_limit_login_attempts.php#L105",
+            "source": "[email protected]"
+        },
+        {
+            "url": "https://plugins.trac.wordpress.org/changeset/3220003/",
+            "source": "[email protected]"
+        },
+        {
+            "url": "https://wordpress.org/plugins/wpextended/#developers",
+            "source": "[email protected]"
+        },
+        {
+            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/abab29c7-88a9-4c6f-9691-ed9087cde2ff?source=cve",
+            "source": "[email protected]"
+        }
+    ]
+}
diff --git a/2024/CVE-2024-13375.json b/2024/CVE-2024-13375.json
@@ -0,0 +1,60 @@
+{
+    "id": "CVE-2024-13375",
+    "sourceIdentifier": "[email protected]",
+    "published": "2025-01-18T09:15:07.120",
+    "lastModified": "2025-01-18T09:15:07.120",
+    "vulnStatus": "Received",
+    "cveTags": [],
+    "descriptions": [
+        {
+            "lang": "en",
+            "value": "The Adifier System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.1.7. This is due to the plugin not properly validating a user's identity prior to updating their details like password through the adifier_recover() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account."
+        }
+    ],
+    "metrics": {
+        "cvssMetricV31": [
+            {
+                "source": "[email protected]",
+                "type": "Primary",
+                "cvssData": {
+                    "version": "3.1",
+                    "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+                    "baseScore": 9.8,
+                    "baseSeverity": "CRITICAL",
+                    "attackVector": "NETWORK",
+                    "attackComplexity": "LOW",
+                    "privilegesRequired": "NONE",
+                    "userInteraction": "NONE",
+                    "scope": "UNCHANGED",
+                    "confidentialityImpact": "HIGH",
+                    "integrityImpact": "HIGH",
+                    "availabilityImpact": "HIGH"
+                },
+                "exploitabilityScore": 3.9,
+                "impactScore": 5.9
+            }
+        ]
+    },
+    "weaknesses": [
+        {
+            "source": "[email protected]",
+            "type": "Primary",
+            "description": [
+                {
+                    "lang": "en",
+                    "value": "CWE-620"
+                }
+            ]
+        }
+    ],
+    "references": [
+        {
+            "url": "https://themeforest.net/item/adifier-classified-ads-wordpress-theme/21633950",
+            "source": "[email protected]"
+        },
+        {
+            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fbf2aeed-0f18-4ef6-aff8-9e8c4531d789?source=cve",
+            "source": "[email protected]"
+        }
+    ]
+}
diff --git a/2025/CVE-2025-0537.json b/2025/CVE-2025-0537.json
@@ -2,7 +2,7 @@
     "id": "CVE-2025-0537",
     "sourceIdentifier": "[email protected]",
     "published": "2025-01-17T20:15:29.767",
-    "lastModified": "2025-01-17T20:15:29.767",
+    "lastModified": "2025-01-18T09:15:07.307",
     "vulnStatus": "Received",
     "cveTags": [],
     "descriptions": [
@@ -59,7 +59,7 @@
         "cvssMetricV31": [
             {
                 "source": "[email protected]",
-                "type": "Primary",
+                "type": "Secondary",
                 "cvssData": {
                     "version": "3.1",
                     "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
@@ -107,7 +107,7 @@
     "weaknesses": [
         {
             "source": "[email protected]",
-            "type": "Primary",
+            "type": "Secondary",
             "description": [
                 {
                     "lang": "en",
@@ -126,7 +126,7 @@
             "source": "[email protected]"
         },
         {
-            "url": "https://github.com/aaryan-11-x/My-CVEs/blob/main/Stored%20XSS%20-%20Code-Projects%20Online%20Car%20Rental%20System%201.0.md",
+            "url": "https://github.com/aaryan-11-x/My-CVEs/blob/main/CVE-2025-0537.md",
             "source": "[email protected]"
         },
         {

diff --git a/2025/CVE-2025-0538.json b/2025/CVE-2025-0538.json
@@ -2,7 +2,7 @@
     "id": "CVE-2025-0538",
     "sourceIdentifier": "[email protected]",
     "published": "2025-01-17T21:15:10.847",
-    "lastModified": "2025-01-17T21:15:10.847",
+    "lastModified": "2025-01-18T09:15:07.570",
     "vulnStatus": "Received",
     "cveTags": [],
     "descriptions": [
@@ -59,7 +59,7 @@
         "cvssMetricV31": [
             {
                 "source": "[email protected]",
-                "type": "Primary",
+                "type": "Secondary",
                 "cvssData": {
                     "version": "3.1",
                     "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
@@ -107,7 +107,7 @@
     "weaknesses": [
         {
             "source": "[email protected]",
-            "type": "Primary",
+            "type": "Secondary",
             "description": [
                 {
                     "lang": "en",
@@ -126,7 +126,7 @@
             "source": "[email protected]"
         },
         {
-            "url": "https://github.com/aaryan-11-x/My-CVEs/blob/main/Stored%20XSS%20-%20Code-Projects%20Tourism%20Management%20System%201.0.md",
+            "url": "https://github.com/aaryan-11-x/My-CVEs/blob/main/CVE-2025-0538.md",
             "source": "[email protected]"
         },
         {

diff --git a/2025/CVE-2025-0557.json b/2025/CVE-2025-0557.json
@@ -0,0 +1,137 @@
+{
+    "id": "CVE-2025-0557",
+    "sourceIdentifier": "[email protected]",
+    "published": "2025-01-18T09:15:07.710",
+    "lastModified": "2025-01-18T09:15:07.710",
+    "vulnStatus": "Received",
+    "cveTags": [],
+    "descriptions": [
+        {
+            "lang": "en",
+            "value": "A vulnerability classified as problematic has been found in Hyland Alfresco Community Edition and Alfresco Enterprise Edition up to 6.2.2. This affects an unknown part of the file /share/s/ of the component URL Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0 is able to address this issue. It is recommended to upgrade the affected component."
+        }
+    ],
+    "metrics": {
+        "cvssMetricV40": [
+            {
+                "source": "[email protected]",
+                "type": "Secondary",
+                "cvssData": {
+                    "version": "4.0",
+                    "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
+                    "baseScore": 6.9,
+                    "baseSeverity": "MEDIUM",
+                    "attackVector": "NETWORK",
+                    "attackComplexity": "LOW",
+                    "attackRequirements": "NONE",
+                    "privilegesRequired": "NONE",
+                    "userInteraction": "NONE",
+                    "vulnerableSystemConfidentiality": "NONE",
+                    "vulnerableSystemIntegrity": "LOW",
+                    "vulnerableSystemAvailability": "NONE",
+                    "subsequentSystemConfidentiality": "NONE",
+                    "subsequentSystemIntegrity": "NONE",
+                    "subsequentSystemAvailability": "NONE",
+                    "exploitMaturity": "NOT_DEFINED",
+                    "confidentialityRequirements": "NOT_DEFINED",
+                    "integrityRequirements": "NOT_DEFINED",
+                    "availabilityRequirements": "NOT_DEFINED",
+                    "modifiedAttackVector": "NOT_DEFINED",
+                    "modifiedAttackComplexity": "NOT_DEFINED",
+                    "modifiedAttackRequirements": "NOT_DEFINED",
+                    "modifiedPrivilegesRequired": "NOT_DEFINED",
+                    "modifiedUserInteraction": "NOT_DEFINED",
+                    "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED",
+                    "modifiedVulnerableSystemIntegrity": "NOT_DEFINED",
+                    "modifiedVulnerableSystemAvailability": "NOT_DEFINED",
+                    "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED",
+                    "modifiedSubsequentSystemIntegrity": "NOT_DEFINED",
+                    "modifiedSubsequentSystemAvailability": "NOT_DEFINED",
+                    "safety": "NOT_DEFINED",
+                    "automatable": "NOT_DEFINED",
+                    "recovery": "NOT_DEFINED",
+                    "valueDensity": "NOT_DEFINED",
+                    "vulnerabilityResponseEffort": "NOT_DEFINED",
+                    "providerUrgency": "NOT_DEFINED"
+                }
+            }
+        ],
+        "cvssMetricV31": [
+            {
+                "source": "[email protected]",
+                "type": "Primary",
+                "cvssData": {
+                    "version": "3.1",
+                    "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
+                    "baseScore": 4.3,
+                    "baseSeverity": "MEDIUM",
+                    "attackVector": "NETWORK",
+                    "attackComplexity": "LOW",
+                    "privilegesRequired": "NONE",
+                    "userInteraction": "REQUIRED",
+                    "scope": "UNCHANGED",
+                    "confidentialityImpact": "NONE",
+                    "integrityImpact": "LOW",
+                    "availabilityImpact": "NONE"
+                },
+                "exploitabilityScore": 2.8,
+                "impactScore": 1.4
+            }
+        ],
+        "cvssMetricV2": [
+            {
+                "source": "[email protected]",
+                "type": "Secondary",
+                "cvssData": {
+                    "version": "2.0",
+                    "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
+                    "baseScore": 5.0,
+                    "accessVector": "NETWORK",
+                    "accessComplexity": "LOW",
+                    "authentication": "NONE",
+                    "confidentialityImpact": "NONE",
+                    "integrityImpact": "PARTIAL",
+                    "availabilityImpact": "NONE"
+                },
+                "baseSeverity": "MEDIUM",
+                "exploitabilityScore": 10.0,
+                "impactScore": 2.9,
+                "acInsufInfo": false,
+                "obtainAllPrivilege": false,
+                "obtainUserPrivilege": false,
+                "obtainOtherPrivilege": false,
+                "userInteractionRequired": false
+            }
+        ]
+    },
+    "weaknesses": [
+        {
+            "source": "[email protected]",
+            "type": "Primary",
+            "description": [
+                {
+                    "lang": "en",
+                    "value": "CWE-79"
+                },
+                {
+                    "lang": "en",
+                    "value": "CWE-94"
+                }
+            ]
+        }
+    ],
+    "references": [
+        {
+            "url": "https://vuldb.com/?ctiid.292491",
+            "source": "[email protected]"
+        },
+        {
+            "url": "https://vuldb.com/?id.292491",
+            "source": "[email protected]"
+        },
+        {
+            "url": "https://vuldb.com/?submit.474306",
+            "source": "[email protected]"
+        }
+    ]
+}