From 58ad0165fcb253a5105a4210def72d826f1d24c4 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 23 Apr 2025 12:32:46 +0000 Subject: [PATCH] Publish Advisories GHSA-cqj4-fp95-jqxq GHSA-j3qr-8f3v-fgjj GHSA-9hcv-xw76-m4h6 GHSA-26g6-6369-5jmc GHSA-gw5v-3q9m-pxcv GHSA-h3j2-jhfw-78g2 GHSA-j7h5-c7xg-wp5c GHSA-jm2g-3f56-rvvh GHSA-p2mq-5mvf-j4j6 GHSA-w7cv-qc5c-8g8f GHSA-x5gg-4843-j4xj GHSA-xjqh-wp4h-xm3r --- .../GHSA-cqj4-fp95-jqxq.json | 6 ++- .../GHSA-j3qr-8f3v-fgjj.json | 6 ++- .../GHSA-9hcv-xw76-m4h6.json | 6 ++- .../GHSA-26g6-6369-5jmc.json | 36 +++++++++++++++++ .../GHSA-gw5v-3q9m-pxcv.json | 36 +++++++++++++++++ .../GHSA-h3j2-jhfw-78g2.json | 40 +++++++++++++++++++ .../GHSA-j7h5-c7xg-wp5c.json | 36 +++++++++++++++++ .../GHSA-jm2g-3f56-rvvh.json | 40 +++++++++++++++++++ .../GHSA-p2mq-5mvf-j4j6.json | 36 +++++++++++++++++ .../GHSA-w7cv-qc5c-8g8f.json | 36 +++++++++++++++++ .../GHSA-x5gg-4843-j4xj.json | 36 +++++++++++++++++ .../GHSA-xjqh-wp4h-xm3r.json | 36 +++++++++++++++++ 12 files changed, 347 insertions(+), 3 deletions(-) create mode 100644 advisories/unreviewed/2025/04/GHSA-26g6-6369-5jmc/GHSA-26g6-6369-5jmc.json create mode 100644 advisories/unreviewed/2025/04/GHSA-gw5v-3q9m-pxcv/GHSA-gw5v-3q9m-pxcv.json create mode 100644 advisories/unreviewed/2025/04/GHSA-h3j2-jhfw-78g2/GHSA-h3j2-jhfw-78g2.json create mode 100644 advisories/unreviewed/2025/04/GHSA-j7h5-c7xg-wp5c/GHSA-j7h5-c7xg-wp5c.json create mode 100644 advisories/unreviewed/2025/04/GHSA-jm2g-3f56-rvvh/GHSA-jm2g-3f56-rvvh.json create mode 100644 advisories/unreviewed/2025/04/GHSA-p2mq-5mvf-j4j6/GHSA-p2mq-5mvf-j4j6.json create mode 100644 advisories/unreviewed/2025/04/GHSA-w7cv-qc5c-8g8f/GHSA-w7cv-qc5c-8g8f.json create mode 100644 advisories/unreviewed/2025/04/GHSA-x5gg-4843-j4xj/GHSA-x5gg-4843-j4xj.json create mode 100644 advisories/unreviewed/2025/04/GHSA-xjqh-wp4h-xm3r/GHSA-xjqh-wp4h-xm3r.json diff --git a/advisories/unreviewed/2025/02/GHSA-cqj4-fp95-jqxq/GHSA-cqj4-fp95-jqxq.json b/advisories/unreviewed/2025/02/GHSA-cqj4-fp95-jqxq/GHSA-cqj4-fp95-jqxq.json index f9c6b358980..fa189027365 100644 --- a/advisories/unreviewed/2025/02/GHSA-cqj4-fp95-jqxq/GHSA-cqj4-fp95-jqxq.json +++ b/advisories/unreviewed/2025/02/GHSA-cqj4-fp95-jqxq/GHSA-cqj4-fp95-jqxq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-cqj4-fp95-jqxq", - "modified": "2025-02-22T00:33:50Z", + "modified": "2025-04-23T12:31:25Z", "published": "2025-02-10T18:30:46Z", "aliases": [ "CVE-2024-12243" @@ -19,6 +19,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12243" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:4051" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-12243" diff --git a/advisories/unreviewed/2025/02/GHSA-j3qr-8f3v-fgjj/GHSA-j3qr-8f3v-fgjj.json b/advisories/unreviewed/2025/02/GHSA-j3qr-8f3v-fgjj/GHSA-j3qr-8f3v-fgjj.json index 6a692c796fd..9641053bbb7 100644 --- a/advisories/unreviewed/2025/02/GHSA-j3qr-8f3v-fgjj/GHSA-j3qr-8f3v-fgjj.json +++ b/advisories/unreviewed/2025/02/GHSA-j3qr-8f3v-fgjj/GHSA-j3qr-8f3v-fgjj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j3qr-8f3v-fgjj", - "modified": "2025-02-21T15:31:59Z", + "modified": "2025-04-23T12:31:25Z", "published": "2025-02-10T18:30:47Z", "aliases": [ "CVE-2024-12133" @@ -19,6 +19,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12133" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:4049" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-12133" diff --git a/advisories/unreviewed/2025/03/GHSA-9hcv-xw76-m4h6/GHSA-9hcv-xw76-m4h6.json b/advisories/unreviewed/2025/03/GHSA-9hcv-xw76-m4h6/GHSA-9hcv-xw76-m4h6.json index 648bf21306e..40566227264 100644 --- a/advisories/unreviewed/2025/03/GHSA-9hcv-xw76-m4h6/GHSA-9hcv-xw76-m4h6.json +++ b/advisories/unreviewed/2025/03/GHSA-9hcv-xw76-m4h6/GHSA-9hcv-xw76-m4h6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9hcv-xw76-m4h6", - "modified": "2025-04-15T18:31:41Z", + "modified": "2025-04-23T12:31:25Z", "published": "2025-03-14T09:34:06Z", "aliases": [ "CVE-2024-8176" @@ -35,6 +35,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:3913" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:4048" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-8176" diff --git a/advisories/unreviewed/2025/04/GHSA-26g6-6369-5jmc/GHSA-26g6-6369-5jmc.json b/advisories/unreviewed/2025/04/GHSA-26g6-6369-5jmc/GHSA-26g6-6369-5jmc.json new file mode 100644 index 00000000000..891a50331bd --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-26g6-6369-5jmc/GHSA-26g6-6369-5jmc.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-26g6-6369-5jmc", + "modified": "2025-04-23T12:31:25Z", + "published": "2025-04-23T12:31:25Z", + "aliases": [ + "CVE-2025-42605" + ], + "details": "This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for the initiation, modification, or cancellation operations. An authenticated remote attacker could exploit this vulnerability by manipulating parameter in the API request body to gain unauthorized access to other user accounts.\n\nSuccessful exploitation of this vulnerability could allow remote attacker to perform authorized manipulation of data associated with other user accounts.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42605" + }, + { + "type": "WEB", + "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-23T11:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-gw5v-3q9m-pxcv/GHSA-gw5v-3q9m-pxcv.json b/advisories/unreviewed/2025/04/GHSA-gw5v-3q9m-pxcv/GHSA-gw5v-3q9m-pxcv.json new file mode 100644 index 00000000000..b04c22bde78 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-gw5v-3q9m-pxcv/GHSA-gw5v-3q9m-pxcv.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gw5v-3q9m-pxcv", + "modified": "2025-04-23T12:31:25Z", + "published": "2025-04-23T12:31:25Z", + "aliases": [ + "CVE-2025-42601" + ], + "details": "This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remote attacker could exploit this vulnerability by intercepting the request and removing the Captcha parameter leading to bypassing the Captcha verification mechanism.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42601" + }, + { + "type": "WEB", + "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-602" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-23T11:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-h3j2-jhfw-78g2/GHSA-h3j2-jhfw-78g2.json b/advisories/unreviewed/2025/04/GHSA-h3j2-jhfw-78g2/GHSA-h3j2-jhfw-78g2.json new file mode 100644 index 00000000000..9a59587571e --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-h3j2-jhfw-78g2/GHSA-h3j2-jhfw-78g2.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h3j2-jhfw-78g2", + "modified": "2025-04-23T12:31:25Z", + "published": "2025-04-23T12:31:25Z", + "aliases": [ + "CVE-2025-1054" + ], + "details": "The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the UI Counter, UI Icon Box, UI Testimonial Slider, UI Testimonial Grid, and UI Testimonial Carousel widgets in all versions up to, and including, 1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1054" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3253371/uicore-elements" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d74e8541-9726-4bc2-9fbd-f6016490e0ea?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-23T10:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-j7h5-c7xg-wp5c/GHSA-j7h5-c7xg-wp5c.json b/advisories/unreviewed/2025/04/GHSA-j7h5-c7xg-wp5c/GHSA-j7h5-c7xg-wp5c.json new file mode 100644 index 00000000000..0a70f85b2eb --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-j7h5-c7xg-wp5c/GHSA-j7h5-c7xg-wp5c.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j7h5-c7xg-wp5c", + "modified": "2025-04-23T12:31:25Z", + "published": "2025-04-23T12:31:25Z", + "aliases": [ + "CVE-2025-42602" + ], + "details": "This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentication process. A remote attacker could exploit this vulnerability by intercepting and manipulating the responses through API request body leading to unauthorized access of other user accounts.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42602" + }, + { + "type": "WEB", + "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-384" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-23T11:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-jm2g-3f56-rvvh/GHSA-jm2g-3f56-rvvh.json b/advisories/unreviewed/2025/04/GHSA-jm2g-3f56-rvvh/GHSA-jm2g-3f56-rvvh.json new file mode 100644 index 00000000000..16fdb7d2fef --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-jm2g-3f56-rvvh/GHSA-jm2g-3f56-rvvh.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jm2g-3f56-rvvh", + "modified": "2025-04-23T12:31:25Z", + "published": "2025-04-23T12:31:25Z", + "aliases": [ + "CVE-2024-10306" + ], + "details": "A vulnerability was found in mod_proxy_cluster. The issue is that the directive should be replaced by the directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10306" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-10306" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321302" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-23T10:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-p2mq-5mvf-j4j6/GHSA-p2mq-5mvf-j4j6.json b/advisories/unreviewed/2025/04/GHSA-p2mq-5mvf-j4j6/GHSA-p2mq-5mvf-j4j6.json new file mode 100644 index 00000000000..7fc5826db3b --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-p2mq-5mvf-j4j6/GHSA-p2mq-5mvf-j4j6.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p2mq-5mvf-j4j6", + "modified": "2025-04-23T12:31:26Z", + "published": "2025-04-23T12:31:25Z", + "aliases": [ + "CVE-2025-2703" + ], + "details": "The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. \n\nA user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2703" + }, + { + "type": "WEB", + "url": "https://grafana.com/security/security-advisories/cve-2025-2703" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-23T12:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-w7cv-qc5c-8g8f/GHSA-w7cv-qc5c-8g8f.json b/advisories/unreviewed/2025/04/GHSA-w7cv-qc5c-8g8f/GHSA-w7cv-qc5c-8g8f.json new file mode 100644 index 00000000000..93bc33e9a38 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-w7cv-qc5c-8g8f/GHSA-w7cv-qc5c-8g8f.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w7cv-qc5c-8g8f", + "modified": "2025-04-23T12:31:25Z", + "published": "2025-04-23T12:31:25Z", + "aliases": [ + "CVE-2025-42603" + ], + "details": "This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting API response that contains unencrypted sensitive information belonging to other users.\n\nSuccessful exploitation of this vulnerability could allow remote attacker to impersonate the target user and gain unauthorized access to the user account.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42603" + }, + { + "type": "WEB", + "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-319" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-23T11:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-x5gg-4843-j4xj/GHSA-x5gg-4843-j4xj.json b/advisories/unreviewed/2025/04/GHSA-x5gg-4843-j4xj/GHSA-x5gg-4843-j4xj.json new file mode 100644 index 00000000000..b390c529ffa --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-x5gg-4843-j4xj/GHSA-x5gg-4843-j4xj.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x5gg-4843-j4xj", + "modified": "2025-04-23T12:31:25Z", + "published": "2025-04-23T12:31:25Z", + "aliases": [ + "CVE-2025-42604" + ], + "details": "This vulnerability exists in Meon KYC solutions due to debug mode is enabled in certain API endpoints. A remote attacker could exploit this vulnerability by accessing certain unauthorized API endpoints leading to detailed error messages as response leading to disclosure of system related information.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42604" + }, + { + "type": "WEB", + "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1295" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-23T11:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-xjqh-wp4h-xm3r/GHSA-xjqh-wp4h-xm3r.json b/advisories/unreviewed/2025/04/GHSA-xjqh-wp4h-xm3r/GHSA-xjqh-wp4h-xm3r.json new file mode 100644 index 00000000000..df8c9e313a6 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-xjqh-wp4h-xm3r/GHSA-xjqh-wp4h-xm3r.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xjqh-wp4h-xm3r", + "modified": "2025-04-23T12:31:25Z", + "published": "2025-04-23T12:31:25Z", + "aliases": [ + "CVE-2025-42600" + ], + "details": "This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password (OTP) attempts through certain API endpoints of login process. A remote attacker could exploit this vulnerability by performing a brute force attack on OTP, which could lead to gain unauthorized access to other user accounts.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42600" + }, + { + "type": "WEB", + "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0082" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-307" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-23T11:15:46Z" + } +} \ No newline at end of file