CVE-2025-27414

CVE-2025-27414

Título es
CVE-2025-27414

Vie, 28/02/2025 – 21:15

Tipo
CWE-287

Gravedad 2.0 Txt
Pendiente de análisis

Título en

CVE-2025-27414

Descripción en
MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to
RELEASE.2025-02-28T09-55-16Z, a bug in evaluating the trust of the SSH key used in an SFTP connection to MinIO allows authentication bypass and unauthorized data access. On a MinIO server with SFTP access configured and using LDAP as an external identity provider, MinIO supports SSH key based authentication for SFTP connections when the user has the `sshPublicKey` attribute set in their LDAP server. The server trusts the client's key only when the public key is the same as the `sshPublicKey` attribute. Due to the bug, when the user has no `sshPublicKey` property in LDAP, the server ends up trusting the key allowing the client to perform any FTP operations allowed by the MinIO access policies associated with the LDAP user (or any of their groups). Three requirements must be met in order to exploit the vulnerability. First, the MinIO server must be configured to allow SFTP access and use LDAP as an external identity provider. Second, the attacker must have knowledge of an LDAP username that does not have the `sshPublicKey` property set. Third, such an LDAP username or one of their groups must also have some MinIO access policy configured. When this bug is successfully exploited, the attacker can perform any FTP operations (i.e. reading, writing, deleting and listing objects) allowed by the access policy associated with the LDAP user account (and their groups). Version 1.2.0 fixes the issue.

28/02/2025

28/02/2025

Vector CVSS:4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Gravedad 4.0
4.60

Gravedad 4.0 txt
MEDIUM

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
Pendiente de análisis

Referencias


  • https://github.com/minio/minio/commit/4c71f1b4ec0fb2a473ddaac18c20ec9e63f267ec

  • https://github.com/minio/minio/commit/91e1487de45720753c9e9e4c02b1bd16b7e452fa

  • https://github.com/minio/minio/security/advisories/GHSA-wc79-7x8x-2p58

    • Enviar en el boletín
    Off

    CVE-2025-27413

    CVE-2025-27413

    Título es
    CVE-2025-27413

    Vie, 28/02/2025 – 21:15

    Tipo
    CWE-22

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-27413

    Descripción en
    PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal (`../`) sequences. This is problematic for the template update functionality as it uses the path from the database to write arbitrary content to, potentially overwriting source code to achieve Remote Code Execution. Any user with the `backups:create`, `backups:update` and `templates:update` permissions (only administrators by default) can write arbitrary content to anywhere on the filesystem. By overwriting source code, it is possible to achieve Remote Code Execution. Version 1.2.0 fixes the issue.

    28/02/2025

    28/02/2025

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    6.50

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias


  • https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/models/template.js#L170-L175

  • https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/routes/backup.js#L826-L827

  • https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/routes/template.js#L63-L66

  • https://github.com/pwndoc/pwndoc/commit/68aa1ea676a91e17bfb333a27571151bd07fb21d

  • https://github.com/pwndoc/pwndoc/releases/tag/v1.2.0

  • https://github.com/pwndoc/pwndoc/security/advisories/GHSA-r3vj-47cf-4672

    • Enviar en el boletín
    Off

    CVE-2025-27410

    CVE-2025-27410

    Título es
    CVE-2025-27410

    Vie, 28/02/2025 – 21:15

    Tipo
    CWE-22

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-27410

    Descripción en
    PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included `.js` file and restarting the container, this allows for Remote Code Execution as an administrator. The remote code execution occurs because any user with the `backups:create` and `backups:update` (only administrators by default) is able to overwrite any file on the system. Version 1.2.0 fixes the issue.

    28/02/2025

    28/02/2025

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    6.50

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias


  • https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/routes/backup.js#L527

  • https://github.com/pwndoc/pwndoc/commit/98f284291d73d3a0b11d3181d845845c192d1080

  • https://github.com/pwndoc/pwndoc/releases/tag/v1.2.0

  • https://github.com/pwndoc/pwndoc/security/advisories/GHSA-mxw8-vgvx-89hx

    • Enviar en el boletín
    Off

    CVE-2024-1509

    CVE-2024-1509

    Título es
    CVE-2024-1509

    Vie, 28/02/2025 – 22:15

    Tipo
    CWE-523

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-1509

    Descripción en
    Brocade ASCG before 3.2.0 Web Interface is not
    enforcing HSTS, as defined by RFC 6797. HSTS is an optional response
    header that can be configured on the server to instruct the browser to
    only communicate via HTTPS. The lack of HSTS allows downgrade attacks,
    SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking
    protections.

    28/02/2025

    28/02/2025

    Vector CVSS:4.0
    CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    Gravedad 4.0
    7.60

    Gravedad 4.0 txt
    HIGH

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25428

    • Enviar en el boletín
    Off

    CVE-2025-26466

    CVE-2025-26466

    Título es
    CVE-2025-26466

    Vie, 28/02/2025 – 22:15

    Tipo
    CWE-400

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-26466

    Descripción en
    A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

    28/02/2025

    28/02/2025

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    5.90

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias


  • https://access.redhat.com/security/cve/CVE-2025-26466

  • https://bugzilla.redhat.com/show_bug.cgi?id=2345043

  • https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt

  • https://security.netapp.com/advisory/ntap-20250228-0002/

    • Enviar en el boletín
    Off

    CVE-2025-25379

    CVE-2025-25379

    Título es
    CVE-2025-25379

    Vie, 28/02/2025 – 23:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-25379

    Descripción en
    Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the del.html component.

    01/03/2025

    01/03/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://github.com/R2og/Sun-jialiang/tree/main/9/readme.md

    • Enviar en el boletín
    Off

    CVE-2025-25478

    CVE-2025-25478

    Título es
    CVE-2025-25478

    Vie, 28/02/2025 – 23:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-25478

    Descripción en
    The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of the web application s source code, exposing sensitive information such as the database password.

    01/03/2025

    01/03/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478

    • Enviar en el boletín
    Off

    CVE-2025-25476

    CVE-2025-25476

    Título es
    CVE-2025-25476

    Vie, 28/02/2025 – 23:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-25476

    Descripción en
    A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Javascript code by specifying a malicious XSS payload as a notification type or notification component.

    01/03/2025

    01/03/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25476

    • Enviar en el boletín
    Off

    CVE-2025-25609

    CVE-2025-25609

    Título es
    CVE-2025-25609

    Vie, 28/02/2025 – 19:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-25609

    Descripción en
    TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the static_ipv6 parameter in the formIpv6Setup interface of /bin/boa

    28/02/2025

    28/02/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://github.com/SunnyYANGyaya/firmcrosser/blob/main/ToTolink/TOTOLINK-A3002R-formIpv6Setup-static_ipv6.md

    • Enviar en el boletín
    Off