Skip to content

Commit 2838a42

Browse files
cad-safe-botcad-safe-bot
committedMar 16, 2025·
Auto-Update: 2025-03-16T19:00:19.503600+00:00
·
v2025.03.17-010004
1 parent 871edb3 commit 2838a42

File tree

6 files changed

+317
-16
lines changed

6 files changed

+317
-16
lines changed
 

‎CVE-2024/CVE-2024-101xx/CVE-2024-10153.json

+7-3
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22
"id": "CVE-2024-10153",
33
"sourceIdentifier": "cna@vuldb.com",
44
"published": "2024-10-19T18:15:02.437",
5-
"lastModified": "2024-10-22T14:45:04.670",
6-
"vulnStatus": "Analyzed",
5+
"lastModified": "2025-03-16T18:15:11.503",
6+
"vulnStatus": "Modified",
77
"cveTags": [],
88
"descriptions": [
99
{
1010
"lang": "en",
11-
"value": "A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file book-boat.php?bid=1 of the component Book a Boat Page. The manipulation of the argument nopeople leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used."
11+
"value": "A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file book-boat.php?bid=1 of the component Book a Boat Page. The manipulation of the argument bookingdatefrom/nopeople leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well."
1212
},
1313
{
1414
"lang": "es",
@@ -133,6 +133,10 @@
133133
"source": "cna@vuldb.com",
134134
"type": "Primary",
135135
"description": [
136+
{
137+
"lang": "en",
138+
"value": "CWE-74"
139+
},
136140
{
137141
"lang": "en",
138142
"value": "CWE-89"

‎CVE-2025/CVE-2025-23xx/CVE-2025-2343.json

+141
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
{
2+
"id": "CVE-2025-2343",
3+
"sourceIdentifier": "cna@vuldb.com",
4+
"published": "2025-03-16T18:15:11.830",
5+
"lastModified": "2025-03-16T18:15:11.830",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "A vulnerability classified as critical was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this vulnerability is an unknown functionality of the component Device Pairing. The manipulation leads to hard-coded credentials. Access to the local network is required for this attack to succeed. The complexity of an attack is rather high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV40": [
16+
{
17+
"source": "cna@vuldb.com",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "4.0",
21+
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
22+
"baseScore": 7.7,
23+
"baseSeverity": "HIGH",
24+
"attackVector": "ADJACENT",
25+
"attackComplexity": "HIGH",
26+
"attackRequirements": "NONE",
27+
"privilegesRequired": "NONE",
28+
"userInteraction": "NONE",
29+
"vulnConfidentialityImpact": "HIGH",
30+
"vulnIntegrityImpact": "HIGH",
31+
"vulnAvailabilityImpact": "HIGH",
32+
"subConfidentialityImpact": "NONE",
33+
"subIntegrityImpact": "NONE",
34+
"subAvailabilityImpact": "NONE",
35+
"exploitMaturity": "NOT_DEFINED",
36+
"confidentialityRequirement": "NOT_DEFINED",
37+
"integrityRequirement": "NOT_DEFINED",
38+
"availabilityRequirement": "NOT_DEFINED",
39+
"modifiedAttackVector": "NOT_DEFINED",
40+
"modifiedAttackComplexity": "NOT_DEFINED",
41+
"modifiedAttackRequirements": "NOT_DEFINED",
42+
"modifiedPrivilegesRequired": "NOT_DEFINED",
43+
"modifiedUserInteraction": "NOT_DEFINED",
44+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
45+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
46+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
47+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
48+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
49+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
50+
"Safety": "NOT_DEFINED",
51+
"Automatable": "NOT_DEFINED",
52+
"Recovery": "NOT_DEFINED",
53+
"valueDensity": "NOT_DEFINED",
54+
"vulnerabilityResponseEffort": "NOT_DEFINED",
55+
"providerUrgency": "NOT_DEFINED"
56+
}
57+
}
58+
],
59+
"cvssMetricV31": [
60+
{
61+
"source": "cna@vuldb.com",
62+
"type": "Primary",
63+
"cvssData": {
64+
"version": "3.1",
65+
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
66+
"baseScore": 7.5,
67+
"baseSeverity": "HIGH",
68+
"attackVector": "ADJACENT_NETWORK",
69+
"attackComplexity": "HIGH",
70+
"privilegesRequired": "NONE",
71+
"userInteraction": "NONE",
72+
"scope": "UNCHANGED",
73+
"confidentialityImpact": "HIGH",
74+
"integrityImpact": "HIGH",
75+
"availabilityImpact": "HIGH"
76+
},
77+
"exploitabilityScore": 1.6,
78+
"impactScore": 5.9
79+
}
80+
],
81+
"cvssMetricV2": [
82+
{
83+
"source": "cna@vuldb.com",
84+
"type": "Secondary",
85+
"cvssData": {
86+
"version": "2.0",
87+
"vectorString": "AV:A/AC:H/Au:N/C:C/I:C/A:C",
88+
"baseScore": 6.8,
89+
"accessVector": "ADJACENT_NETWORK",
90+
"accessComplexity": "HIGH",
91+
"authentication": "NONE",
92+
"confidentialityImpact": "COMPLETE",
93+
"integrityImpact": "COMPLETE",
94+
"availabilityImpact": "COMPLETE"
95+
},
96+
"baseSeverity": "MEDIUM",
97+
"exploitabilityScore": 3.2,
98+
"impactScore": 10.0,
99+
"acInsufInfo": false,
100+
"obtainAllPrivilege": false,
101+
"obtainUserPrivilege": false,
102+
"obtainOtherPrivilege": false,
103+
"userInteractionRequired": false
104+
}
105+
]
106+
},
107+
"weaknesses": [
108+
{
109+
"source": "cna@vuldb.com",
110+
"type": "Primary",
111+
"description": [
112+
{
113+
"lang": "en",
114+
"value": "CWE-259"
115+
},
116+
{
117+
"lang": "en",
118+
"value": "CWE-798"
119+
}
120+
]
121+
}
122+
],
123+
"references": [
124+
{
125+
"url": "https://github.com/geo-chen/IROAD#finding-3-bypassing-of-device-pairing-cwe-798-for-iroad-x-series",
126+
"source": "cna@vuldb.com"
127+
},
128+
{
129+
"url": "https://vuldb.com/?ctiid.299809",
130+
"source": "cna@vuldb.com"
131+
},
132+
{
133+
"url": "https://vuldb.com/?id.299809",
134+
"source": "cna@vuldb.com"
135+
},
136+
{
137+
"url": "https://vuldb.com/?submit.516881",
138+
"source": "cna@vuldb.com"
139+
}
140+
]
141+
}

‎CVE-2025/CVE-2025-23xx/CVE-2025-2344.json

+141
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
{
2+
"id": "CVE-2025-2344",
3+
"sourceIdentifier": "cna@vuldb.com",
4+
"published": "2025-03-16T18:15:12.113",
5+
"lastModified": "2025-03-16T18:15:12.113",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "A vulnerability, which was classified as critical, has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this issue is some unknown functionality of the component API Endpoint. The manipulation leads to missing authentication. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV40": [
16+
{
17+
"source": "cna@vuldb.com",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "4.0",
21+
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
22+
"baseScore": 6.9,
23+
"baseSeverity": "MEDIUM",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"attackRequirements": "NONE",
27+
"privilegesRequired": "NONE",
28+
"userInteraction": "NONE",
29+
"vulnConfidentialityImpact": "LOW",
30+
"vulnIntegrityImpact": "NONE",
31+
"vulnAvailabilityImpact": "NONE",
32+
"subConfidentialityImpact": "NONE",
33+
"subIntegrityImpact": "NONE",
34+
"subAvailabilityImpact": "NONE",
35+
"exploitMaturity": "NOT_DEFINED",
36+
"confidentialityRequirement": "NOT_DEFINED",
37+
"integrityRequirement": "NOT_DEFINED",
38+
"availabilityRequirement": "NOT_DEFINED",
39+
"modifiedAttackVector": "NOT_DEFINED",
40+
"modifiedAttackComplexity": "NOT_DEFINED",
41+
"modifiedAttackRequirements": "NOT_DEFINED",
42+
"modifiedPrivilegesRequired": "NOT_DEFINED",
43+
"modifiedUserInteraction": "NOT_DEFINED",
44+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
45+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
46+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
47+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
48+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
49+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
50+
"Safety": "NOT_DEFINED",
51+
"Automatable": "NOT_DEFINED",
52+
"Recovery": "NOT_DEFINED",
53+
"valueDensity": "NOT_DEFINED",
54+
"vulnerabilityResponseEffort": "NOT_DEFINED",
55+
"providerUrgency": "NOT_DEFINED"
56+
}
57+
}
58+
],
59+
"cvssMetricV31": [
60+
{
61+
"source": "cna@vuldb.com",
62+
"type": "Primary",
63+
"cvssData": {
64+
"version": "3.1",
65+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
66+
"baseScore": 5.3,
67+
"baseSeverity": "MEDIUM",
68+
"attackVector": "NETWORK",
69+
"attackComplexity": "LOW",
70+
"privilegesRequired": "NONE",
71+
"userInteraction": "NONE",
72+
"scope": "UNCHANGED",
73+
"confidentialityImpact": "LOW",
74+
"integrityImpact": "NONE",
75+
"availabilityImpact": "NONE"
76+
},
77+
"exploitabilityScore": 3.9,
78+
"impactScore": 1.4
79+
}
80+
],
81+
"cvssMetricV2": [
82+
{
83+
"source": "cna@vuldb.com",
84+
"type": "Secondary",
85+
"cvssData": {
86+
"version": "2.0",
87+
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
88+
"baseScore": 5.0,
89+
"accessVector": "NETWORK",
90+
"accessComplexity": "LOW",
91+
"authentication": "NONE",
92+
"confidentialityImpact": "PARTIAL",
93+
"integrityImpact": "NONE",
94+
"availabilityImpact": "NONE"
95+
},
96+
"baseSeverity": "MEDIUM",
97+
"exploitabilityScore": 10.0,
98+
"impactScore": 2.9,
99+
"acInsufInfo": false,
100+
"obtainAllPrivilege": false,
101+
"obtainUserPrivilege": false,
102+
"obtainOtherPrivilege": false,
103+
"userInteractionRequired": false
104+
}
105+
]
106+
},
107+
"weaknesses": [
108+
{
109+
"source": "cna@vuldb.com",
110+
"type": "Primary",
111+
"description": [
112+
{
113+
"lang": "en",
114+
"value": "CWE-287"
115+
},
116+
{
117+
"lang": "en",
118+
"value": "CWE-306"
119+
}
120+
]
121+
}
122+
],
123+
"references": [
124+
{
125+
"url": "https://github.com/geo-chen/IROAD#finding-4-remotely-dump-video-footage-and-live-video-stream",
126+
"source": "cna@vuldb.com"
127+
},
128+
{
129+
"url": "https://vuldb.com/?ctiid.299810",
130+
"source": "cna@vuldb.com"
131+
},
132+
{
133+
"url": "https://vuldb.com/?id.299810",
134+
"source": "cna@vuldb.com"
135+
},
136+
{
137+
"url": "https://vuldb.com/?submit.516882",
138+
"source": "cna@vuldb.com"
139+
}
140+
]
141+
}

‎CVE-2025/CVE-2025-300xx/CVE-2025-30066.json

+13-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"id": "CVE-2025-30066",
33
"sourceIdentifier": "cve@mitre.org",
44
"published": "2025-03-15T06:15:12.193",
5-
"lastModified": "2025-03-16T05:15:10.333",
5+
"lastModified": "2025-03-16T17:15:36.070",
66
"vulnStatus": "Received",
77
"cveTags": [],
88
"descriptions": [
@@ -103,6 +103,18 @@
103103
{
104104
"url": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised",
105105
"source": "cve@mitre.org"
106+
},
107+
{
108+
"url": "https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond",
109+
"source": "cve@mitre.org"
110+
},
111+
{
112+
"url": "https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack",
113+
"source": "cve@mitre.org"
114+
},
115+
{
116+
"url": "https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066",
117+
"source": "cve@mitre.org"
106118
}
107119
]
108120
}

‎README.md

+8-7
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
1313
### Last Repository Update
1414

1515
```plain
16-
2025-03-16T17:00:19.513724+00:00
16+
2025-03-16T19:00:19.503600+00:00
1717
```
1818

1919
### Most recent CVE Modification Timestamp synchronized with NVD
2020

2121
```plain
22-
2025-03-16T16:15:11.613000+00:00
22+
2025-03-16T18:15:12.113000+00:00
2323
```
2424

2525
### Last Data Feed Release
@@ -33,22 +33,23 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
3333
### Total Number of included CVEs
3434

3535
```plain
36-
285350
36+
285352
3737
```
3838

3939
### CVEs added in the last Commit
4040

4141
Recently added CVEs: `2`
4242

43-
- [CVE-2025-2341](CVE-2025/CVE-2025-23xx/CVE-2025-2341.json) (`2025-03-16T15:15:36.523`)
44-
- [CVE-2025-2342](CVE-2025/CVE-2025-23xx/CVE-2025-2342.json) (`2025-03-16T16:15:11.613`)
43+
- [CVE-2025-2343](CVE-2025/CVE-2025-23xx/CVE-2025-2343.json) (`2025-03-16T18:15:11.830`)
44+
- [CVE-2025-2344](CVE-2025/CVE-2025-23xx/CVE-2025-2344.json) (`2025-03-16T18:15:12.113`)
4545

4646

4747
### CVEs modified in the last Commit
4848

49-
Recently modified CVEs: `1`
49+
Recently modified CVEs: `2`
5050

51-
- [CVE-2024-11879](CVE-2024/CVE-2024-118xx/CVE-2024-11879.json) (`2025-03-16T15:15:36.407`)
51+
- [CVE-2024-10153](CVE-2024/CVE-2024-101xx/CVE-2024-10153.json) (`2025-03-16T18:15:11.503`)
52+
- [CVE-2025-30066](CVE-2025/CVE-2025-300xx/CVE-2025-30066.json) (`2025-03-16T17:15:36.070`)
5253

5354

5455
## Download and Usage

0 commit comments

Comments
 (0)