7.3
CVE-2025-0509
- EPSS 0.02%
- Veröffentlicht 04.02.2025 20:15:49
- Zuletzt bearbeitet 05.08.2025 14:35:15
- Quelle patrick@puiterwijk.org
- Teams Watchlist Login
- Unerledigt Login
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sparkle-project ≫ Sparkle Version < 2.6.4
Netapp ≫ Hci Compute Node Version-
Netapp ≫ Oncommand Workflow Automation Version-
Netapp ≫ Hci Compute Node Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.02% | 0.044 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.8 | 0.9 | 5.9 |
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| patrick@puiterwijk.org | 7.3 | 0.7 | 6 |
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
|
CWE-552 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.