CVE-2025-26216

CVE-2025-26216

Título es
CVE-2025-26216

Vie, 14/03/2025 – 17:15

Gravedad 2.0 Txt
Pendiente de análisis

Título en

CVE-2025-26216

Descripción en
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

14/03/2025

14/03/2025

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
Pendiente de análisis

Enviar en el boletín
Off

CVE-2025-26215

CVE-2025-26215

Título es
CVE-2025-26215

Vie, 14/03/2025 – 17:15

Gravedad 2.0 Txt
Pendiente de análisis

Título en

CVE-2025-26215

Descripción en
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

14/03/2025

14/03/2025

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
Pendiente de análisis

Enviar en el boletín
Off

CVE-2025-29774

CVE-2025-29774

Título es
CVE-2025-29774

Vie, 14/03/2025 – 17:15

Tipo
CWE-347

Gravedad 2.0 Txt
Pendiente de análisis

Título en

CVE-2025-29774

Descripción en
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker with a valid account to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively.

14/03/2025

14/03/2025

Vector CVSS:4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Gravedad 4.0
9.30

Gravedad 4.0 txt
CRITICAL

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
Pendiente de análisis

Referencias


  • https://github.com/node-saml/xml-crypto/commit/28f92218ecbb8dcbd238afa4efbbd50302aa9aed

  • https://github.com/node-saml/xml-crypto/commit/886dc63a8b4bb5ae1db9f41c7854b171eb83aa98

  • https://github.com/node-saml/xml-crypto/commit/8ac6118ee7978b46aa56b82cbcaa5fca58c93a07

  • https://github.com/node-saml/xml-crypto/releases/tag/v2.1.6

  • https://github.com/node-saml/xml-crypto/releases/tag/v3.2.1

  • https://github.com/node-saml/xml-crypto/releases/tag/v6.0.1

  • https://github.com/node-saml/xml-crypto/security/advisories/GHSA-9p8x-f768-wp2g

    • Enviar en el boletín
    Off

    CVE-2025-29387

    CVE-2025-29387

    Título es
    CVE-2025-29387

    Vie, 14/03/2025 – 17:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-29387

    Descripción en
    In Tenda AC9 v1.0 V15.03.05.14_multi, the wanSpeed parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.

    14/03/2025

    14/03/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://github.com/shuqi233/loophole/blob/main/Tenda%20AC9/AdvSetMacMtuWan2.md

    • Enviar en el boletín
    Off

    CVE-2025-29386

    CVE-2025-29386

    Título es
    CVE-2025-29386

    Vie, 14/03/2025 – 17:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-29386

    Descripción en
    In Tenda AC9 v1.0 V15.03.05.14_multi, the mac parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.

    14/03/2025

    14/03/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://github.com/shuqi233/loophole/blob/main/Tenda%20AC9/AdvSetMacMtuWan4.md

    • Enviar en el boletín
    Off

    CVE-2025-29385

    CVE-2025-29385

    Título es
    CVE-2025-29385

    Vie, 14/03/2025 – 17:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-29385

    Descripción en
    In Tenda AC9 v1.0 V15.03.05.14_multi, the cloneType parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.

    14/03/2025

    14/03/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://github.com/shuqi233/loophole/blob/main/Tenda%20AC9/AdvSetMacMtuWan3.md

    • Enviar en el boletín
    Off

    CVE-2025-29384

    CVE-2025-29384

    Título es
    CVE-2025-29384

    Vie, 14/03/2025 – 17:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-29384

    Descripción en
    In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.

    14/03/2025

    14/03/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://github.com/shuqi233/loophole/blob/main/Tenda%20AC9/AdvSetMacMtuWan1.md

    • Enviar en el boletín
    Off

    CVE-2025-27606

    CVE-2025-27606

    Título es
    CVE-2025-27606

    Vie, 14/03/2025 – 17:15

    Tipo
    CWE-488

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-27606

    Descripción en
    Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wrong PIN more than the configured amount of times. An attacker with physical access to a device can exploit this to guess the PIN. Version 1.6.34 solves the issue.

    14/03/2025

    14/03/2025

    Vector CVSS:3.1
    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    5.10

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias


  • https://github.com/element-hq/element-android/commit/53bd78b05de375c6e6b0b5aa794a56b4ba95984c

  • https://github.com/element-hq/element-android/commit/87d7fcdc8036a4db4da8c403f87c73a64a546304

  • https://github.com/element-hq/element-android/security/advisories/GHSA-632v-9pm3-m8ch

    • Enviar en el boletín
    Off

    CVE-2023-52927

    CVE-2023-52927

    Título es
    CVE-2023-52927

    Vie, 14/03/2025 – 15:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2023-52927

    Descripción en
    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: allow exp not to be removed in nf_ct_find_expectation

    Currently nf_conntrack_in() calling nf_ct_find_expectation() will
    remove the exp from the hash table. However, in some scenario, we
    expect the exp not to be removed when the created ct will not be
    confirmed, like in OVS and TC conntrack in the following patches.

    This patch allows exp not to be removed by setting IPS_CONFIRMED
    in the status of the tmpl.

    14/03/2025

    14/03/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://git.kernel.org/stable/c/3fa58a6fbd1e9e5682d09cdafb08fba004cb12ec

  • https://git.kernel.org/stable/c/4914109a8e1e494c6aa9852f9e84ec77a5fc643f

    • Enviar en el boletín
    Off

    CVE-2024-40590

    CVE-2024-40590

    Título es
    CVE-2024-40590

    Vie, 14/03/2025 – 15:15

    Tipo
    CWE-295

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-40590

    Descripción en
    An improper certificate validation vulnerability [CWE-295] in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, version 6.0.15 and below when connecting to a FortiManager device, a FortiAnalyzer device, or an SMTP server may allow an unauthenticated attacker in a Man-in-the-Middle position to intercept on and tamper with the encrypted communication channel established between the FortiPortal and those endpoints.

    14/03/2025

    14/03/2025

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    4.80

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias


  • https://fortiguard.fortinet.com/psirt/FG-IR-22-155

    • Enviar en el boletín
    Off