7.3
CVE-2025-0509
- EPSS 0.02%
- Published 04.02.2025 20:15:49
- Last modified 05.08.2025 14:35:15
- Source patrick@puiterwijk.org
- Teams watchlist Login
- Open Login
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
Data is provided by the National Vulnerability Database (NVD)
Sparkle-project ≫ Sparkle Version < 2.6.4
Netapp ≫ Hci Compute Node Version-
Netapp ≫ Oncommand Workflow Automation Version-
Netapp ≫ Hci Compute Node Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.02% | 0.044 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 6.8 | 0.9 | 5.9 |
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| patrick@puiterwijk.org | 7.3 | 0.7 | 6 |
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
|
CWE-552 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.