CVE-2025-0524

CVE-2025-0524

Título es
CVE-2025-0524

Sáb, 15/03/2025 – 23:15

Gravedad 2.0 Txt
Pendiente de análisis

Título en

CVE-2025-0524

Descripción en
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

16/03/2025

16/03/2025

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
Pendiente de análisis

Enviar en el boletín
Off

CVE-2025-25225

CVE-2025-25225

Título es
CVE-2025-25225

Sáb, 15/03/2025 – 18:15

Tipo
CWE-284

Gravedad 2.0 Txt
Pendiente de análisis

Título en

CVE-2025-25225

Descripción en
A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions.

15/03/2025

15/03/2025

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
Pendiente de análisis

Referencias


  • https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-25225

  • https://www.hikashop.com/

    • Enviar en el boletín
    Off

    CVE-2025-2323

    CVE-2025-2323

    Título es
    CVE-2025-2323

    Sáb, 15/03/2025 – 17:15

    Tipo
    CWE-840

    Gravedad v2.0
    4.00

    Gravedad 2.0 Txt
    MEDIUM

    Título en

    CVE-2025-2323

    Descripción en
    A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been declared as problematic. This vulnerability affects the function updateQuestionCou of the file /api/mjkj-chat/chat/mng/update/questionCou of the component Number of Question Handler. The manipulation leads to enforcement of behavioral workflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

    15/03/2025

    15/03/2025

    Vector CVSS:4.0
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

    Vector CVSS:2.0
    AV:N/AC:L/Au:S/C:N/I:P/A:N

    Gravedad 4.0
    5.30

    Gravedad 4.0 txt
    MEDIUM

    Gravedad 3.1 (CVSS 3.1 Base Score)
    4.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias


  • https://vuldb.com/?ctiid_299752=

  • https://vuldb.com/?id_299752=

  • https://vuldb.com/?submit_505695=

  • https://www.cnblogs.com/aibot/p/18732309

    • Enviar en el boletín
    Off

    CVE-2025-1530

    CVE-2025-1530

    Título es
    CVE-2025-1530

    Sáb, 15/03/2025 – 12:15

    Tipo
    CWE-352

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-1530

    Descripción en
    The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to missing nonce validation. This makes it possible for unauthenticated attackers to delete arbitrary results via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

    15/03/2025

    15/03/2025

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    4.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias


  • https://plugins.trac.wordpress.org/browser/tripetto/trunk/lib/capabilities.php

  • https://plugins.trac.wordpress.org/changeset/3251202/

  • https://plugins.trac.wordpress.org/changeset/3251202/tripetto/trunk/admin/results/list.php

  • https://plugins.trac.wordpress.org/changeset/3251202/tripetto/trunk/admin/results/results.php

  • WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto



  • https://www.wordfence.com/threat-intel/vulnerabilities/id/dd80abd9-3f41-414a-a781-9bff7d85ec4b?source=cve

    • Enviar en el boletín
    Off

    CVE-2025-2333

    CVE-2025-2333

    Título es
    CVE-2025-2333

    Sáb, 15/03/2025 – 12:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-2333

    Descripción en
    Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.

    15/03/2025

    15/03/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Enviar en el boletín
    Off

    CVE-2025-2321

    CVE-2025-2321

    Título es
    CVE-2025-2321

    Sáb, 15/03/2025 – 12:15

    Tipo
    CWE-840

    Gravedad v2.0
    6.50

    Gravedad 2.0 Txt
    MEDIUM

    Título en

    CVE-2025-2321

    Descripción en
    A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this issue is some unknown functionality of the file /api/mjkj-chat/cgform-api/addData/. The manipulation of the argument chatUserID leads to business logic errors. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

    15/03/2025

    15/03/2025

    Vector CVSS:4.0
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

    Vector CVSS:2.0
    AV:N/AC:L/Au:S/C:P/I:P/A:P

    Gravedad 4.0
    5.30

    Gravedad 4.0 txt
    MEDIUM

    Gravedad 3.1 (CVSS 3.1 Base Score)
    6.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias


  • https://vuldb.com/?ctiid_299750=

  • https://vuldb.com/?id_299750=

  • https://vuldb.com/?submit_505690=

  • https://www.cnblogs.com/aibot/p/18732250

    • Enviar en el boletín
    Off

    CVE-2025-2025

    CVE-2025-2025

    Título es
    CVE-2025-2025

    Sáb, 15/03/2025 – 12:15

    Tipo
    CWE-862

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-2025

    Descripción en
    The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports.

    15/03/2025

    15/03/2025

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    6.50

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias


  • https://plugins.trac.wordpress.org/browser/give/trunk/includes/admin/reports/reports.php#L304

  • https://plugins.trac.wordpress.org/changeset/3252319/

  • GiveWP – Donation Plugin and Fundraising Platform



  • https://www.wordfence.com/threat-intel/vulnerabilities/id/40595943-121d-4492-a0ed-f2de1bd99fda?source=cve

    • Enviar en el boletín
    Off

    CVE-2025-2322

    CVE-2025-2322

    Título es
    CVE-2025-2322

    Sáb, 15/03/2025 – 14:15

    Tipo
    CWE-259

    Gravedad v2.0
    7.50

    Gravedad 2.0 Txt
    HIGH

    Título en

    CVE-2025-2322

    Descripción en
    A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been classified as critical. This affects an unknown part of the file /chatgpt-boot/src/main/java/org/springblade/modules/mjkj/controller/OpenController.java. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

    15/03/2025

    15/03/2025

    Vector CVSS:4.0
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

    Vector CVSS:2.0
    AV:N/AC:L/Au:N/C:P/I:P/A:P

    Gravedad 4.0
    6.90

    Gravedad 4.0 txt
    MEDIUM

    Gravedad 3.1 (CVSS 3.1 Base Score)
    7.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias


  • https://vuldb.com/?ctiid_299751=

  • https://vuldb.com/?id_299751=

  • https://vuldb.com/?submit_505694=

  • https://www.cnblogs.com/aibot/p/18732299

    • Enviar en el boletín
    Off

    CVE-2025-1057

    CVE-2025-1057

    Título es
    CVE-2025-1057

    Sáb, 15/03/2025 – 09:15

    Tipo
    CWE-704

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-1057

    Descripción en
    A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store agent registration data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registration requests, causing the agent to fail.

    15/03/2025

    15/03/2025

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

    Gravedad 3.1 (CVSS 3.1 Base Score)
    4.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias


  • https://access.redhat.com/security/cve/CVE-2025-1057

  • https://bugzilla.redhat.com/show_bug.cgi?id=2343894

    • Enviar en el boletín
    Off

    CVE-2025-30066

    CVE-2025-30066

    Título es
    CVE-2025-30066

    Sáb, 15/03/2025 – 06:15

    Tipo
    CWE-506

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-30066

    Descripción en
    tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were not originally affected, but were modified by a threat actor to point at commit 0e58ed8, which contains the malicious updateFeatures code.)

    15/03/2025

    15/03/2025

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    8.60

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias


  • https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193

  • https://github.com/tj-actions/changed-files/issues/2463

  • https://news.ycombinator.com/item?id=43368870

  • https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/

  • https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised

    • Enviar en el boletín
    Off