CVE-2025-25907

CVE-2025-25907

Título es
CVE-2025-25907

Lun, 10/03/2025 – 22:15

Gravedad 2.0 Txt
Pendiente de análisis

Título en

CVE-2025-25907

Descripción en
tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request.

10/03/2025

10/03/2025

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
Pendiente de análisis

Referencias


  • https://github.com/xujeff/tianti/issues/39

    • Enviar en el boletín
    Off

    CVE-2025-27910

    CVE-2025-27910

    Título es
    CVE-2025-27910

    Lun, 10/03/2025 – 22:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-27910

    Descripción en
    tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/upd/status. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request.

    10/03/2025

    10/03/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://github.com/xujeff/tianti/issues/39

    • Enviar en el boletín
    Off

    CVE-2025-25908

    CVE-2025-25908

    Título es
    CVE-2025-25908

    Lun, 10/03/2025 – 22:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-25908

    Descripción en
    A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save.

    10/03/2025

    10/03/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://github.com/xujeff/tianti/issues/40

    • Enviar en el boletín
    Off

    CVE-2025-27926

    CVE-2025-27926

    Título es
    CVE-2025-27926

    Lun, 10/03/2025 – 23:15

    Tipo
    CWE-276

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-27926

    Descripción en
    In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by unauthorized users.

    11/03/2025

    11/03/2025

    Vector CVSS:3.1
    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    4.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias


  • https://help.nintex.com/en-US/platform/ReleaseNotes/K2Five.htm

    • Enviar en el boletín
    Off

    CVE-2025-27925

    CVE-2025-27925

    Título es
    CVE-2025-27925

    Lun, 10/03/2025 – 23:15

    Tipo
    CWE-502

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-27925

    Descripción en
    Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.

    11/03/2025

    11/03/2025

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    8.50

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias


  • https://help.nintex.com/en-US/platform/ReleaseNotes/K2Five.htm

    • Enviar en el boletín
    Off

    CVE-2025-27924

    CVE-2025-27924

    Título es
    CVE-2025-27924

    Lun, 10/03/2025 – 23:15

    Tipo
    CWE-79

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-27924

    Descripción en
    Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action.

    11/03/2025

    11/03/2025

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    5.40

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias


  • https://help.nintex.com/en-US/platform/ReleaseNotes/K2Five.htm

    • Enviar en el boletín
    Off

    CVE-2025-27610

    CVE-2025-27610

    Título es
    CVE-2025-27610

    Lun, 10/03/2025 – 23:15

    Tipo
    CWE-23

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-27610

    Descripción en
    Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly. The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Other mitigations include removing usage of `Rack::Static`, or ensuring that `root:` points at a directory path which only contains files which should be accessed publicly. It is likely that a CDN or similar static file server would also mitigate the issue.

    11/03/2025

    11/03/2025

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    7.50

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias


  • https://github.com/rack/rack/commit/50caab74fa01ee8f5dbdee7bb2782126d20c6583

  • https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v

    • Enviar en el boletín
    Off

    CVE-2022-48610

    CVE-2022-48610

    Título es
    CVE-2022-48610

    Lun, 10/03/2025 – 20:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2022-48610

    Descripción en
    This issue was addressed through improved state management. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2. An app may be able to access user-sensitive data.

    10/03/2025

    10/03/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://support.apple.com/en-us/102741

  • https://support.apple.com/en-us/102807

  • https://support.apple.com/en-us/102808

    • Enviar en el boletín
    Off

    CVE-2022-43454

    CVE-2022-43454

    Título es
    CVE-2022-43454

    Lun, 10/03/2025 – 20:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2022-43454

    Descripción en
    A double free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An app may be able to execute arbitrary code with kernel privileges.

    10/03/2025

    10/03/2025

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://support.apple.com/en-us/102741

  • https://support.apple.com/en-us/102807

  • https://support.apple.com/en-us/102808

  • https://support.apple.com/en-us/102836

    • Enviar en el boletín
    Off

    CVE-2025-22603

    CVE-2025-22603

    Título es
    CVE-2025-22603

    Lun, 10/03/2025 – 19:15

    Tipo
    CWE-918

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-22603

    Descripción en
    AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Versions prior to autogpt-platform-beta-v0.4.2 contains a server-side request forgery (SSRF) vulnerability inside component (or block) `Send Web Request`. The root cause is that IPV6 address is not restricted or filtered, which allows attackers to perform a server side request forgery to visit an IPV6 service. autogpt-platform-beta-v0.4.2 fixes the issue.

    10/03/2025

    10/03/2025

    Vector CVSS:4.0
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    Gravedad 4.0
    7.70

    Gravedad 4.0 txt
    HIGH

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias


  • https://boatneck-faucet-cba.notion.site/SSRF-of-AutoGPT-153b650a4d88804d923ad65a015a7d61

  • https://github.com/Significant-Gravitas/AutoGPT/blob/2121ffd06b26a438706bf642372cc46d81c94ddc/autogpt_platform/backend/backend/util/request.py#L11

  • https://github.com/Significant-Gravitas/AutoGPT/commit/26214e1b2c6777e0fae866642b23420adaadd6c4

  • https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-4c8v-hwxc-2356

    • Enviar en el boletín
    Off