Skip to content

Commit 7aa6f10

Browse files
westonsteimelwestonsteimel
committed
updates 2025-04-15
Signed-off-by: Weston Steimel <[email protected]>
1 parent fbbab1a commit 7aa6f10

10 files changed

+145
-5
lines changed

‎data/anchore/2024/CVE-2024-25090.json

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,13 @@
1212
"affected": [
1313
{
1414
"cpes": [
15-
"cpe:2.3:a:apache:roller:*:*:*:*:*:*:*:*"
15+
"cpe:2.3:a:apache:roller:*:*:*:*:*:maven:*:*",
16+
"cpe:2.3:a:org.apache.roller:roller-webapp:*:*:*:*:*:maven:*:*"
1617
],
18+
"packageName": "org.apache.roller:roller-webapp",
19+
"packageType": "maven",
1720
"product": "Apache Roller",
21+
"repo": "http://git-wip-us.apache.org/repos/asf/roller.git",
1822
"vendor": "Apache Software Foundation",
1923
"versions": [
2024
{

‎data/anchore/2024/CVE-2024-45038.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
{
1414
"collectionURL": "https://github.com",
1515
"cpes": [
16-
"cpe:2.3:a:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*"
16+
"cpe:2.3:o:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*"
1717
],
1818
"packageName": "meshtastic/firmware",
1919
"product": "firmware",

‎data/anchore/2024/CVE-2024-46911.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
"packageName": "org.apache.roller:roller-webapp",
1919
"packageType": "maven",
2020
"product": "Apache Roller",
21+
"repo": "http://git-wip-us.apache.org/repos/asf/roller.git",
2122
"vendor": "Apache Software Foundation",
2223
"versions": [
2324
{

‎data/anchore/2024/CVE-2024-47079.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
{
1414
"collectionURL": "https://github.com",
1515
"cpes": [
16-
"cpe:2.3:a:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*"
16+
"cpe:2.3:o:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*"
1717
],
1818
"packageName": "meshtastic/firmware",
1919
"product": "firmware",

‎data/anchore/2024/CVE-2024-51500.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
{
1414
"collectionURL": "https://github.com",
1515
"cpes": [
16-
"cpe:2.3:a:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*"
16+
"cpe:2.3:o:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*"
1717
],
1818
"packageName": "meshtastic/firmware",
1919
"product": "firmware",

‎data/anchore/2024/CVE-2024-9230.json

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"additionalMetadata": {
3+
"cna": "wpscan",
4+
"cveId": "CVE-2024-9230",
5+
"description": "The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site Scripting attacks",
6+
"reason": "Added CPE configurations because not yet analyzed by NVD.",
7+
"references": [
8+
"https://wpscan.com/vulnerability/ab5eaf57-fb61-4a08-b439-42dea40b7914/"
9+
],
10+
"upstream": {
11+
"datePublished": "2025-04-14T06:00:04.686Z",
12+
"dateReserved": "2024-09-26T18:10:12.484Z",
13+
"dateUpdated": "2025-04-14T14:22:16.658Z",
14+
"digest": "f881746652e93136acb061b33160c1ad45cc773e6ac1a27270cd90f12c529306"
15+
}
16+
},
17+
"adp": {
18+
"affected": [
19+
{
20+
"collectionURL": "https://wordpress.org/plugins",
21+
"cpes": [
22+
"cpe:2.3:a:blubrry:powerpress:*:*:*:*:*:wordpress:*:*"
23+
],
24+
"packageName": "powerpress",
25+
"packageType": "wordpress-plugin",
26+
"product": "PowerPress Podcasting plugin by Blubrry",
27+
"repo": "https://plugins.svn.wordpress.org/powerpress",
28+
"versions": [
29+
{
30+
"lessThan": "11.9.18",
31+
"status": "affected",
32+
"version": "0",
33+
"versionType": "semver"
34+
}
35+
]
36+
}
37+
],
38+
"providerMetadata": {
39+
"orgId": "00000000-0000-4000-8000-000000000000",
40+
"shortName": "anchoreadp"
41+
}
42+
}
43+
}

‎data/anchore/2025/CVE-2025-21608.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
{
2020
"collectionURL": "https://github.com",
2121
"cpes": [
22-
"cpe:2.3:a:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*"
22+
"cpe:2.3:o:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*"
2323
],
2424
"packageName": "meshtastic/firmware",
2525
"product": "firmware",

‎data/anchore/2025/CVE-2025-24797.json

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"additionalMetadata": {
3+
"cna": "github_m",
4+
"cveId": "CVE-2025-24797",
5+
"description": "Meshtastic is an open source mesh networking solution. A fault in the handling of mesh packets containing invalid protobuf data can result in an attacker-controlled buffer overflow, allowing an attacker to hijack execution flow, potentially resulting in remote code execution. This attack does not require authentication or user interaction, as long as the target device rebroadcasts packets on the default channel. This vulnerability fixed in 2.6.2.",
6+
"reason": "Added CPE configurations because not yet analyzed by NVD.",
7+
"references": [
8+
"https://github.com/meshtastic/firmware/security/advisories/GHSA-33hw-xhfh-944r"
9+
],
10+
"upstream": {
11+
"datePublished": "2025-04-14T23:25:19.152Z",
12+
"dateReserved": "2025-01-23T17:11:35.838Z",
13+
"dateUpdated": "2025-04-15T02:55:53.769Z",
14+
"digest": "83f75e6b421aa0c2d67b443ab5732b5f60f23d4095eaae099a87b920a62a6b07"
15+
}
16+
},
17+
"adp": {
18+
"affected": [
19+
{
20+
"collectionURL": "https://github.com",
21+
"cpes": [
22+
"cpe:2.3:o:meshtastic:meshtastic_firmware:*:*:*:*:*:*:*:*"
23+
],
24+
"packageName": "meshtastic/firmware",
25+
"product": "firmware",
26+
"repo": "https://github.com/meshtastic/firmware",
27+
"vendor": "meshtastic",
28+
"versions": [
29+
{
30+
"lessThan": "2.6.2",
31+
"status": "affected",
32+
"version": "0",
33+
"versionType": "custom"
34+
}
35+
]
36+
}
37+
],
38+
"providerMetadata": {
39+
"orgId": "00000000-0000-4000-8000-000000000000",
40+
"shortName": "anchoreadp"
41+
}
42+
}
43+
}

‎data/anchore/2025/CVE-2025-24859.json

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"additionalMetadata": {
3+
"cna": "apache",
4+
"cveId": "CVE-2025-24859",
5+
"description": "A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This allows continued access to the application through old sessions even after password changes, potentially enabling unauthorized access if credentials were compromised.\n\nThis issue affects Apache Roller versions up to and including 6.1.4.\n\nThe vulnerability is fixed in Apache Roller 6.1.5 by implementing centralized session management that properly invalidates all active sessions when passwords are changed or users are disabled.",
6+
"reason": "Added CPE configurations because not yet analyzed by NVD.",
7+
"references": [
8+
"https://lists.apache.org/thread/4j906k16v21kdx8hk87gl7663sw7lg7f",
9+
"https://lists.apache.org/thread/vxv52vdr8nhtjlj6v02w43fdvo0cxw23"
10+
],
11+
"upstream": {
12+
"datePublished": "2025-04-14T08:18:54.729Z",
13+
"dateReserved": "2025-01-26T22:17:14.419Z",
14+
"dateUpdated": "2025-04-14T13:07:32.570Z",
15+
"digest": "1410aa70b69857f227b7eab158bdfd0fb188bba6761ceeaaed4d83f61ff40ef5"
16+
}
17+
},
18+
"adp": {
19+
"affected": [
20+
{
21+
"cpes": [
22+
"cpe:2.3:a:apache:roller:*:*:*:*:*:maven:*:*",
23+
"cpe:2.3:a:org.apache.roller:roller-webapp:*:*:*:*:*:maven:*:*"
24+
],
25+
"packageName": "org.apache.roller:roller-webapp",
26+
"packageType": "maven",
27+
"product": "Apache Roller",
28+
"repo": "http://git-wip-us.apache.org/repos/asf/roller.git",
29+
"vendor": "Apache Software Foundation",
30+
"versions": [
31+
{
32+
"lessThan": "6.1.5",
33+
"status": "affected",
34+
"version": "1.0.0",
35+
"versionType": "semver"
36+
}
37+
]
38+
}
39+
],
40+
"providerMetadata": {
41+
"orgId": "00000000-0000-4000-8000-000000000000",
42+
"shortName": "anchoreadp"
43+
}
44+
}
45+
}

‎data/anchore/2025/CVE-2025-32200.json

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@
77
"references": [
88
"https://patchstack.com/database/wordpress/plugin/advanced-backgrounds/vulnerability/wordpress-advanced-wordpress-backgrounds-plugin-1-12-4-content-injection-vulnerability?_s_id=cve"
99
],
10+
"rejection": {
11+
"date": "2025-04-14T13:37:58.688Z",
12+
"reason": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
13+
},
1014
"upstream": {
1115
"datePublished": "2025-04-04T15:59:09.196Z",
1216
"dateReserved": "2025-04-04T10:01:28.633Z",

0 commit comments

Comments
 (0)