CVE tracker
315 subscribers
4.47K links
News monitoring: @irnewsagency

Main channel: @orgsecuritygate

Site: SecurityGate.org
Download Telegram
CVE-2025-6817 - HDF5 Resource Consumption Denial of Service

CVE ID : CVE-2025-6817
Published : June 28, 2025, 12:15 p.m. | 4 hours, 3 minutes ago
Description : A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5C__load_entry of the file /src/H5Centry.c. The manipulation leads to resource consumption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-1991 - IBM Informix Dynamic Server Denial of Service Buffer Overflow

CVE ID : CVE-2025-1991
Published : June 28, 2025, 1:15 p.m. | 3 hours, 3 minutes ago
Description : IBM Informix Dynamic Server 12.10,14.10, and15.0 could allow a remote attacker to cause a denial of service due to an integer underflow when processing packets.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-28902 - Skoda MIB3 Infotainment Unit Integer Underflow Denial-of-Service Vulnerability

CVE ID : CVE-2023-28902
Published : June 28, 2025, 4:15 p.m. | 4 hours, 3 minutes ago
Description : An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-service of the infotainment system. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-28903 - MIB3 Infotainment Unit Integer Overflow Denial-of-Service

CVE ID : CVE-2023-28903
Published : June 28, 2025, 4:15 p.m. | 4 hours, 3 minutes ago
Description : An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause a denial-of-service of the infotainment system.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-28904 - MIB3 Infotainment Unit Bootloader Boot Process Code Execution Vulnerability

CVE ID : CVE-2023-28904
Published : June 28, 2025, 4:15 p.m. | 4 hours, 3 minutes ago
Description : A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical access to the MIB3 ECU to bypass firmware signature verification and run arbitrary code in the infotainment system at boot process.
Severity: 5.2 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-28905 - Skoda MIB3 Infotainment Unit Heap Buffer Overflow

CVE ID : CVE-2023-28905
Published : June 28, 2025, 4:15 p.m. | 4 hours, 3 minutes ago
Description : A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Severity: 8.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-28906 - Skoda MIB3 Infotainment Command Injection Vulnerability

CVE ID : CVE-2023-28906
Published : June 28, 2025, 4:15 p.m. | 4 hours, 3 minutes ago
Description : A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privileges and obtain administrative access to the system. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-28907 - Skoda Superb III MIB3 CAN Bus CPU Core Isolation Bypass

CVE ID : CVE-2023-28907
Published : June 28, 2025, 4:15 p.m. | 4 hours, 3 minutes ago
Description : There is no memory isolation between CPU cores of the MIB3 infotainment. This fact allows an attacker with access to the main operating system to compromise the CPU core responsible for CAN message processing. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Severity: 6.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-28908 - Volkswagen MIB3 Bluetooth Integer Overflow Vulnerability

CVE ID : CVE-2023-28908
Published : June 28, 2025, 4:15 p.m. | 4 hours, 3 minutes ago
Description : A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow when receiving non-fragmented HCI packets on a channel. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-28909 - Skoda MIB3 Bluetooth Integer Overflow Remote Code Execution Vulnerability

CVE ID : CVE-2023-28909
Published : June 28, 2025, 4:15 p.m. | 4 hours, 3 minutes ago
Description : A specific flaw exists within the Bluetooth stack of the MIB3 unit. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow when receiving fragmented HCI packets on a channel. An attacker can leverage this vulnerability to bypass the MTU check on a channel with enabled fragmentation. Consequently, this can lead to a buffer overflow in upper layer profiles, which can be used to obtain remote code execution. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Severity: 8.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-28910 - Skoda MIB3 Bluetooth Stack Assertion Bypass Vulnerability

CVE ID : CVE-2023-28910
Published : June 28, 2025, 4:15 p.m. | 4 hours, 3 minutes ago
Description : A specific flaw exists within the Bluetooth stack of the MIB3 infotainment system. The issue results from the disabled abortion flag eventually leading to bypassing assertion functions. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Severity: 8.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-28911 - Skoda MIB3 Bluetooth Stack Channel Disconnection Denial-of-Service Vulnerability

CVE ID : CVE-2023-28911
Published : June 28, 2025, 4:15 p.m. | 4 hours, 3 minutes ago
Description : A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which can result in an arbitrary channel disconnection. An attacker can leverage this vulnerability to cause a denial-of-service attack for every connected client of the infotainment device. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-28912 - Skoda MIB3 In-vehicle Contact Data Disclosure

CVE ID : CVE-2023-28912
Published : June 28, 2025, 4:15 p.m. | 4 hours, 3 minutes ago
Description : The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical access to the system to obtain vehicle owner's contact data. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Severity: 5.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-29113 - Volkswagen Skoda MIB3 Privilege Escalation Vulnerability

CVE ID : CVE-2023-29113
Published : June 28, 2025, 4:15 p.m. | 4 hours, 3 minutes ago
Description : The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication mechanism, leaving attackers with presence in the system an ability to undermine access control restrictions implemented at the operating system level. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-6818 - HDF5 Heap-Based Buffer Overflow Vulnerability

CVE ID : CVE-2025-6818
Published : June 28, 2025, 4:15 p.m. | 4 hours, 3 minutes ago
Description : A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5O__chunk_protect of the file /src/H5Ochunk.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-6819 - Code-projects Inventory Management System SQL Injection Vulnerability

CVE ID : CVE-2025-6819
Published : June 28, 2025, 5:15 p.m. | 3 hours, 3 minutes ago
Description : A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /php_action/removeBrand.php. The manipulation of the argument brandId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-6820 - Code-projects Inventory Management System SQL Injection Vulnerability

CVE ID : CVE-2025-6820
Published : June 28, 2025, 6:15 p.m. | 2 hours, 3 minutes ago
Description : A vulnerability was found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /php_action/createProduct.php. The manipulation of the argument productName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-6821 - Code-projects Inventory Management System SQL Injection Vulnerability

CVE ID : CVE-2025-6821
Published : June 28, 2025, 6:15 p.m. | 2 hours, 3 minutes ago
Description : A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /php_action/createOrder.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-32897 - Apache Seata (incubating) Untrusted Data Deserialization Vulnerability

CVE ID : CVE-2025-32897
Published : June 28, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow. This issue affects Apache Seata (incubating): from 2.0.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-6822 - Code-projects Inventory Management System SQL Injection Vulnerability

CVE ID : CVE-2025-6822
Published : June 28, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /php_action/removeProduct.php. The manipulation of the argument productId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-6823 - Code-projects Inventory Management System SQL Injection Vulnerability

CVE ID : CVE-2025-6823
Published : June 28, 2025, 8:15 p.m. | 4 hours, 3 minutes ago
Description : A vulnerability was found in code-projects Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /php_action/editProduct.php. The manipulation of the argument editProductName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...