Skip to content

Commit e937866

Browse files
cad-safe-botcad-safe-bot
committed
Auto-Update: 2025-08-30T12:00:12.695242+00:00
1 parent 152751f commit e937866

File tree

7 files changed

+654
-9
lines changed

7 files changed

+654
-9
lines changed

‎CVE-2025/CVE-2025-386xx/CVE-2025-38677.json

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"id": "CVE-2025-38677",
3+
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
4+
"published": "2025-08-30T10:15:36.260",
5+
"lastModified": "2025-08-30T10:15:36.260",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid out-of-boundary access in dnode page\n\nAs Jiaming Zhang reported:\n\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x17e/0x800 mm/kasan/report.c:480\n kasan_report+0x147/0x180 mm/kasan/report.c:593\n data_blkaddr fs/f2fs/f2fs.h:3053 [inline]\n f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline]\n f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855\n f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195\n prepare_write_begin fs/f2fs/data.c:3395 [inline]\n f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594\n generic_perform_write+0x2c7/0x910 mm/filemap.c:4112\n f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline]\n f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216\n new_sync_write fs/read_write.c:593 [inline]\n vfs_write+0x546/0xa90 fs/read_write.c:686\n ksys_write+0x149/0x250 fs/read_write.c:738\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe root cause is in the corrupted image, there is a dnode has the same\nnode id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to\naccess block address in dnode at offset 934, however it parses the dnode\nas inode node, so that get_dnode_addr() returns 360, then it tries to\naccess page address from 360 + 934 * 4 = 4096 w/ 4 bytes.\n\nTo fix this issue, let's add sanity check for node id of all direct nodes\nduring f2fs_get_dnode_of_data()."
12+
}
13+
],
14+
"metrics": {},
15+
"references": [
16+
{
17+
"url": "https://git.kernel.org/stable/c/6b7784ea07e6aa044f74b39d6b5af5e28746fc81",
18+
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
19+
},
20+
{
21+
"url": "https://git.kernel.org/stable/c/77de19b6867f2740cdcb6c9c7e50d522b47847a4",
22+
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
23+
},
24+
{
25+
"url": "https://git.kernel.org/stable/c/888aa660144bcb6ec07839da756ee46bfcf7fc53",
26+
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
27+
},
28+
{
29+
"url": "https://git.kernel.org/stable/c/901f62efd6e855f93d8b1175540f29f4dc45ba55",
30+
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
31+
},
32+
{
33+
"url": "https://git.kernel.org/stable/c/92ef491b506a0f4dd971a3a76f86f2d8f5370180",
34+
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
35+
},
36+
{
37+
"url": "https://git.kernel.org/stable/c/a650654365c57407413e9b1f6ff4d539bf2e99ca",
38+
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
39+
},
40+
{
41+
"url": "https://git.kernel.org/stable/c/ee4d13f5407cbdf1216cc258f45492075713889a",
42+
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
43+
},
44+
{
45+
"url": "https://git.kernel.org/stable/c/f1d5093d9fe9f3c74c123741c88666cc853b79c5",
46+
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
47+
}
48+
]
49+
}

‎CVE-2025/CVE-2025-96xx/CVE-2025-9682.json

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
{
2+
"id": "CVE-2025-9682",
3+
"sourceIdentifier": "cna@vuldb.com",
4+
"published": "2025-08-30T10:15:36.433",
5+
"lastModified": "2025-08-30T10:15:36.433",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "A vulnerability has been found in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_cms_assemble_control/jaxrs/design/appdict of the component Personal Profile Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): \"This issue will be fixed in the new version.\""
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV40": [
16+
{
17+
"source": "cna@vuldb.com",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "4.0",
21+
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
22+
"baseScore": 5.1,
23+
"baseSeverity": "MEDIUM",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"attackRequirements": "NONE",
27+
"privilegesRequired": "LOW",
28+
"userInteraction": "PASSIVE",
29+
"vulnConfidentialityImpact": "NONE",
30+
"vulnIntegrityImpact": "LOW",
31+
"vulnAvailabilityImpact": "NONE",
32+
"subConfidentialityImpact": "NONE",
33+
"subIntegrityImpact": "NONE",
34+
"subAvailabilityImpact": "NONE",
35+
"exploitMaturity": "PROOF_OF_CONCEPT",
36+
"confidentialityRequirement": "NOT_DEFINED",
37+
"integrityRequirement": "NOT_DEFINED",
38+
"availabilityRequirement": "NOT_DEFINED",
39+
"modifiedAttackVector": "NOT_DEFINED",
40+
"modifiedAttackComplexity": "NOT_DEFINED",
41+
"modifiedAttackRequirements": "NOT_DEFINED",
42+
"modifiedPrivilegesRequired": "NOT_DEFINED",
43+
"modifiedUserInteraction": "NOT_DEFINED",
44+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
45+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
46+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
47+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
48+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
49+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
50+
"Safety": "NOT_DEFINED",
51+
"Automatable": "NOT_DEFINED",
52+
"Recovery": "NOT_DEFINED",
53+
"valueDensity": "NOT_DEFINED",
54+
"vulnerabilityResponseEffort": "NOT_DEFINED",
55+
"providerUrgency": "NOT_DEFINED"
56+
}
57+
}
58+
],
59+
"cvssMetricV31": [
60+
{
61+
"source": "cna@vuldb.com",
62+
"type": "Primary",
63+
"cvssData": {
64+
"version": "3.1",
65+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
66+
"baseScore": 3.5,
67+
"baseSeverity": "LOW",
68+
"attackVector": "NETWORK",
69+
"attackComplexity": "LOW",
70+
"privilegesRequired": "LOW",
71+
"userInteraction": "REQUIRED",
72+
"scope": "UNCHANGED",
73+
"confidentialityImpact": "NONE",
74+
"integrityImpact": "LOW",
75+
"availabilityImpact": "NONE"
76+
},
77+
"exploitabilityScore": 2.1,
78+
"impactScore": 1.4
79+
}
80+
],
81+
"cvssMetricV2": [
82+
{
83+
"source": "cna@vuldb.com",
84+
"type": "Secondary",
85+
"cvssData": {
86+
"version": "2.0",
87+
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
88+
"baseScore": 4.0,
89+
"accessVector": "NETWORK",
90+
"accessComplexity": "LOW",
91+
"authentication": "SINGLE",
92+
"confidentialityImpact": "NONE",
93+
"integrityImpact": "PARTIAL",
94+
"availabilityImpact": "NONE"
95+
},
96+
"baseSeverity": "MEDIUM",
97+
"exploitabilityScore": 8.0,
98+
"impactScore": 2.9,
99+
"acInsufInfo": false,
100+
"obtainAllPrivilege": false,
101+
"obtainUserPrivilege": false,
102+
"obtainOtherPrivilege": false,
103+
"userInteractionRequired": false
104+
}
105+
]
106+
},
107+
"weaknesses": [
108+
{
109+
"source": "cna@vuldb.com",
110+
"type": "Primary",
111+
"description": [
112+
{
113+
"lang": "en",
114+
"value": "CWE-79"
115+
},
116+
{
117+
"lang": "en",
118+
"value": "CWE-94"
119+
}
120+
]
121+
}
122+
],
123+
"references": [
124+
{
125+
"url": "https://github.com/o2oa/o2oa/issues/179",
126+
"source": "cna@vuldb.com"
127+
},
128+
{
129+
"url": "https://github.com/o2oa/o2oa/issues/179#issue-3332951521",
130+
"source": "cna@vuldb.com"
131+
},
132+
{
133+
"url": "https://github.com/o2oa/o2oa/issues/179#issuecomment-3212879970",
134+
"source": "cna@vuldb.com"
135+
},
136+
{
137+
"url": "https://vuldb.com/?ctiid.321894",
138+
"source": "cna@vuldb.com"
139+
},
140+
{
141+
"url": "https://vuldb.com/?id.321894",
142+
"source": "cna@vuldb.com"
143+
},
144+
{
145+
"url": "https://vuldb.com/?submit.637240",
146+
"source": "cna@vuldb.com"
147+
}
148+
]
149+
}

‎CVE-2025/CVE-2025-96xx/CVE-2025-9683.json

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
{
2+
"id": "CVE-2025-9683",
3+
"sourceIdentifier": "cna@vuldb.com",
4+
"published": "2025-08-30T10:15:36.803",
5+
"lastModified": "2025-08-30T10:15:36.803",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "A vulnerability was found in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /x_cms_assemble_control/jaxrs/form of the component Personal Profile Page. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. The vendor replied in the GitHub issue (translated from simplified Chinese): \"This issue will be fixed in the new version.\""
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV40": [
16+
{
17+
"source": "cna@vuldb.com",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "4.0",
21+
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
22+
"baseScore": 5.1,
23+
"baseSeverity": "MEDIUM",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"attackRequirements": "NONE",
27+
"privilegesRequired": "LOW",
28+
"userInteraction": "PASSIVE",
29+
"vulnConfidentialityImpact": "NONE",
30+
"vulnIntegrityImpact": "LOW",
31+
"vulnAvailabilityImpact": "NONE",
32+
"subConfidentialityImpact": "NONE",
33+
"subIntegrityImpact": "NONE",
34+
"subAvailabilityImpact": "NONE",
35+
"exploitMaturity": "PROOF_OF_CONCEPT",
36+
"confidentialityRequirement": "NOT_DEFINED",
37+
"integrityRequirement": "NOT_DEFINED",
38+
"availabilityRequirement": "NOT_DEFINED",
39+
"modifiedAttackVector": "NOT_DEFINED",
40+
"modifiedAttackComplexity": "NOT_DEFINED",
41+
"modifiedAttackRequirements": "NOT_DEFINED",
42+
"modifiedPrivilegesRequired": "NOT_DEFINED",
43+
"modifiedUserInteraction": "NOT_DEFINED",
44+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
45+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
46+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
47+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
48+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
49+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
50+
"Safety": "NOT_DEFINED",
51+
"Automatable": "NOT_DEFINED",
52+
"Recovery": "NOT_DEFINED",
53+
"valueDensity": "NOT_DEFINED",
54+
"vulnerabilityResponseEffort": "NOT_DEFINED",
55+
"providerUrgency": "NOT_DEFINED"
56+
}
57+
}
58+
],
59+
"cvssMetricV31": [
60+
{
61+
"source": "cna@vuldb.com",
62+
"type": "Primary",
63+
"cvssData": {
64+
"version": "3.1",
65+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
66+
"baseScore": 3.5,
67+
"baseSeverity": "LOW",
68+
"attackVector": "NETWORK",
69+
"attackComplexity": "LOW",
70+
"privilegesRequired": "LOW",
71+
"userInteraction": "REQUIRED",
72+
"scope": "UNCHANGED",
73+
"confidentialityImpact": "NONE",
74+
"integrityImpact": "LOW",
75+
"availabilityImpact": "NONE"
76+
},
77+
"exploitabilityScore": 2.1,
78+
"impactScore": 1.4
79+
}
80+
],
81+
"cvssMetricV2": [
82+
{
83+
"source": "cna@vuldb.com",
84+
"type": "Secondary",
85+
"cvssData": {
86+
"version": "2.0",
87+
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
88+
"baseScore": 4.0,
89+
"accessVector": "NETWORK",
90+
"accessComplexity": "LOW",
91+
"authentication": "SINGLE",
92+
"confidentialityImpact": "NONE",
93+
"integrityImpact": "PARTIAL",
94+
"availabilityImpact": "NONE"
95+
},
96+
"baseSeverity": "MEDIUM",
97+
"exploitabilityScore": 8.0,
98+
"impactScore": 2.9,
99+
"acInsufInfo": false,
100+
"obtainAllPrivilege": false,
101+
"obtainUserPrivilege": false,
102+
"obtainOtherPrivilege": false,
103+
"userInteractionRequired": false
104+
}
105+
]
106+
},
107+
"weaknesses": [
108+
{
109+
"source": "cna@vuldb.com",
110+
"type": "Primary",
111+
"description": [
112+
{
113+
"lang": "en",
114+
"value": "CWE-79"
115+
},
116+
{
117+
"lang": "en",
118+
"value": "CWE-94"
119+
}
120+
]
121+
}
122+
],
123+
"references": [
124+
{
125+
"url": "https://github.com/o2oa/o2oa/issues/180",
126+
"source": "cna@vuldb.com"
127+
},
128+
{
129+
"url": "https://github.com/o2oa/o2oa/issues/180#issue-3332965662",
130+
"source": "cna@vuldb.com"
131+
},
132+
{
133+
"url": "https://github.com/o2oa/o2oa/issues/180#issuecomment-3212879749",
134+
"source": "cna@vuldb.com"
135+
},
136+
{
137+
"url": "https://vuldb.com/?ctiid.321895",
138+
"source": "cna@vuldb.com"
139+
},
140+
{
141+
"url": "https://vuldb.com/?id.321895",
142+
"source": "cna@vuldb.com"
143+
},
144+
{
145+
"url": "https://vuldb.com/?submit.637241",
146+
"source": "cna@vuldb.com"
147+
}
148+
]
149+
}

0 commit comments

Comments
 (0)