Skip to content

Commit 10492cc

Browse files
cad-safe-botcad-safe-bot
committed
Auto-Update: 2025-09-01T08:00:15.203283+00:00
1 parent 50d1831 commit 10492cc

33 files changed

+3305
-36
lines changed

‎CVE-2024/CVE-2024-139xx/CVE-2024-13987.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,20 @@
22
"id": "CVE-2024-13987",
33
"sourceIdentifier": "security@synology.com",
44
"published": "2025-08-29T08:15:31.050",
5-
"lastModified": "2025-08-29T16:24:29.730",
5+
"lastModified": "2025-09-01T02:15:40.770",
66
"vulnStatus": "Awaiting Analysis",
77
"cveTags": [],
88
"descriptions": [
99
{
1010
"lang": "en",
11-
"value": "Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Synology RADIUS Server before 3.0.27-0139 allows remote authenticated users with administrator privileges to read or write limited files in SRM and conduct limited denial-of-service via unspecified vectors."
11+
"value": "Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Synology RADIUS Server allows remote authenticated users with administrator privileges to read or write limited files in SRM and conduct limited denial-of-service via unspecified vectors."
1212
}
1313
],
1414
"metrics": {
1515
"cvssMetricV31": [
1616
{
1717
"source": "security@synology.com",
18-
"type": "Primary",
18+
"type": "Secondary",
1919
"cvssData": {
2020
"version": "3.1",
2121
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
@@ -38,7 +38,7 @@
3838
"weaknesses": [
3939
{
4040
"source": "security@synology.com",
41-
"type": "Primary",
41+
"type": "Secondary",
4242
"description": [
4343
{
4444
"lang": "en",

‎CVE-2025/CVE-2025-207xx/CVE-2025-20703.json

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"id": "CVE-2025-20703",
3+
"sourceIdentifier": "security@mediatek.com",
4+
"published": "2025-09-01T06:15:33.357",
5+
"lastModified": "2025-09-01T06:15:33.357",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01599794; Issue ID: MSV-3708."
12+
}
13+
],
14+
"metrics": {},
15+
"weaknesses": [
16+
{
17+
"source": "security@mediatek.com",
18+
"type": "Primary",
19+
"description": [
20+
{
21+
"lang": "en",
22+
"value": "CWE-125"
23+
}
24+
]
25+
}
26+
],
27+
"references": [
28+
{
29+
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025",
30+
"source": "security@mediatek.com"
31+
}
32+
]
33+
}

‎CVE-2025/CVE-2025-207xx/CVE-2025-20704.json

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"id": "CVE-2025-20704",
3+
"sourceIdentifier": "security@mediatek.com",
4+
"published": "2025-09-01T06:15:34.630",
5+
"lastModified": "2025-09-01T06:15:34.630",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01516959; Issue ID: MSV-3502."
12+
}
13+
],
14+
"metrics": {},
15+
"weaknesses": [
16+
{
17+
"source": "security@mediatek.com",
18+
"type": "Primary",
19+
"description": [
20+
{
21+
"lang": "en",
22+
"value": "CWE-787"
23+
}
24+
]
25+
}
26+
],
27+
"references": [
28+
{
29+
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025",
30+
"source": "security@mediatek.com"
31+
}
32+
]
33+
}

‎CVE-2025/CVE-2025-207xx/CVE-2025-20705.json

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"id": "CVE-2025-20705",
3+
"sourceIdentifier": "security@mediatek.com",
4+
"published": "2025-09-01T06:15:34.800",
5+
"lastModified": "2025-09-01T06:15:34.800",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "In monitor_hang, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09989078; Issue ID: MSV-3964."
12+
}
13+
],
14+
"metrics": {},
15+
"weaknesses": [
16+
{
17+
"source": "security@mediatek.com",
18+
"type": "Primary",
19+
"description": [
20+
{
21+
"lang": "en",
22+
"value": "CWE-416"
23+
}
24+
]
25+
}
26+
],
27+
"references": [
28+
{
29+
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025",
30+
"source": "security@mediatek.com"
31+
}
32+
]
33+
}

‎CVE-2025/CVE-2025-207xx/CVE-2025-20706.json

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"id": "CVE-2025-20706",
3+
"sourceIdentifier": "security@mediatek.com",
4+
"published": "2025-09-01T06:15:34.967",
5+
"lastModified": "2025-09-01T06:15:34.967",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "In mbrain, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09924624; Issue ID: MSV-3826."
12+
}
13+
],
14+
"metrics": {},
15+
"weaknesses": [
16+
{
17+
"source": "security@mediatek.com",
18+
"type": "Primary",
19+
"description": [
20+
{
21+
"lang": "en",
22+
"value": "CWE-416"
23+
}
24+
]
25+
}
26+
],
27+
"references": [
28+
{
29+
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025",
30+
"source": "security@mediatek.com"
31+
}
32+
]
33+
}

‎CVE-2025/CVE-2025-207xx/CVE-2025-20707.json

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"id": "CVE-2025-20707",
3+
"sourceIdentifier": "security@mediatek.com",
4+
"published": "2025-09-01T06:15:35.123",
5+
"lastModified": "2025-09-01T06:15:35.123",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09924201; Issue ID: MSV-3820."
12+
}
13+
],
14+
"metrics": {},
15+
"weaknesses": [
16+
{
17+
"source": "security@mediatek.com",
18+
"type": "Primary",
19+
"description": [
20+
{
21+
"lang": "en",
22+
"value": "CWE-416"
23+
}
24+
]
25+
}
26+
],
27+
"references": [
28+
{
29+
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025",
30+
"source": "security@mediatek.com"
31+
}
32+
]
33+
}

‎CVE-2025/CVE-2025-207xx/CVE-2025-20708.json

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"id": "CVE-2025-20708",
3+
"sourceIdentifier": "security@mediatek.com",
4+
"published": "2025-09-01T06:15:35.287",
5+
"lastModified": "2025-09-01T06:15:35.287",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01123853; Issue ID: MSV-4131."
12+
}
13+
],
14+
"metrics": {},
15+
"weaknesses": [
16+
{
17+
"source": "security@mediatek.com",
18+
"type": "Primary",
19+
"description": [
20+
{
21+
"lang": "en",
22+
"value": "CWE-787"
23+
}
24+
]
25+
}
26+
],
27+
"references": [
28+
{
29+
"url": "https://corp.mediatek.com/product-security-bulletin/September-2025",
30+
"source": "security@mediatek.com"
31+
}
32+
]
33+
}

‎CVE-2025/CVE-2025-548xx/CVE-2025-54857.json

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
{
2+
"id": "CVE-2025-54857",
3+
"sourceIdentifier": "vultures@jpcert.or.jp",
4+
"published": "2025-09-01T06:15:35.453",
5+
"lastModified": "2025-09-01T06:15:35.453",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge BASIC MB-A130 Ver.1.5.8 and earlier. If exploited, a remote unauthenticated attacker may execute arbitrary OS commands with root privileges."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV40": [
16+
{
17+
"source": "vultures@jpcert.or.jp",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "4.0",
21+
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
22+
"baseScore": 9.3,
23+
"baseSeverity": "CRITICAL",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"attackRequirements": "NONE",
27+
"privilegesRequired": "NONE",
28+
"userInteraction": "NONE",
29+
"vulnConfidentialityImpact": "HIGH",
30+
"vulnIntegrityImpact": "HIGH",
31+
"vulnAvailabilityImpact": "HIGH",
32+
"subConfidentialityImpact": "NONE",
33+
"subIntegrityImpact": "NONE",
34+
"subAvailabilityImpact": "NONE",
35+
"exploitMaturity": "NOT_DEFINED",
36+
"confidentialityRequirement": "NOT_DEFINED",
37+
"integrityRequirement": "NOT_DEFINED",
38+
"availabilityRequirement": "NOT_DEFINED",
39+
"modifiedAttackVector": "NOT_DEFINED",
40+
"modifiedAttackComplexity": "NOT_DEFINED",
41+
"modifiedAttackRequirements": "NOT_DEFINED",
42+
"modifiedPrivilegesRequired": "NOT_DEFINED",
43+
"modifiedUserInteraction": "NOT_DEFINED",
44+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
45+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
46+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
47+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
48+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
49+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
50+
"Safety": "NOT_DEFINED",
51+
"Automatable": "NOT_DEFINED",
52+
"Recovery": "NOT_DEFINED",
53+
"valueDensity": "NOT_DEFINED",
54+
"vulnerabilityResponseEffort": "NOT_DEFINED",
55+
"providerUrgency": "NOT_DEFINED"
56+
}
57+
}
58+
],
59+
"cvssMetricV30": [
60+
{
61+
"source": "vultures@jpcert.or.jp",
62+
"type": "Secondary",
63+
"cvssData": {
64+
"version": "3.0",
65+
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
66+
"baseScore": 9.8,
67+
"baseSeverity": "CRITICAL",
68+
"attackVector": "NETWORK",
69+
"attackComplexity": "LOW",
70+
"privilegesRequired": "NONE",
71+
"userInteraction": "NONE",
72+
"scope": "UNCHANGED",
73+
"confidentialityImpact": "HIGH",
74+
"integrityImpact": "HIGH",
75+
"availabilityImpact": "HIGH"
76+
},
77+
"exploitabilityScore": 3.9,
78+
"impactScore": 5.9
79+
}
80+
]
81+
},
82+
"weaknesses": [
83+
{
84+
"source": "vultures@jpcert.or.jp",
85+
"type": "Primary",
86+
"description": [
87+
{
88+
"lang": "en",
89+
"value": "CWE-78"
90+
}
91+
]
92+
}
93+
],
94+
"references": [
95+
{
96+
"url": "https://jvn.jp/en/jp/JVN22016482/",
97+
"source": "vultures@jpcert.or.jp"
98+
},
99+
{
100+
"url": "https://www.seiko-sol.co.jp/archives/90289/",
101+
"source": "vultures@jpcert.or.jp"
102+
}
103+
]
104+
}

0 commit comments

Comments
 (0)