Skip to content

Commit 2f415a8

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-57m6-32gw-8f7j GHSA-5jg2-cjvx-wcpp GHSA-5qmq-gv7w-45x3 GHSA-679c-h9qm-hc7x GHSA-7w84-g65j-5mx7 GHSA-938m-532f-x65h GHSA-f8q6-g9q8-wm72 GHSA-fj49-5pv6-cpp5 GHSA-gqwg-33mc-9c6j GHSA-hxh2-f6m4-698c GHSA-mgf6-wvxv-hr92 GHSA-px4q-7qhm-g854 GHSA-rv2r-wgv2-j88m GHSA-v25h-fv6g-fmcg GHSA-wm7p-28g9-67f7 GHSA-x974-v89x-m6c8
1 parent 2f27bbf commit 2f415a8

16 files changed

Lines changed: 752 additions & 0 deletions

File tree

‎advisories/unreviewed/2025/06/GHSA-57m6-32gw-8f7j/GHSA-57m6-32gw-8f7j.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-57m6-32gw-8f7j",
4+
"modified": "2025-06-28T18:32:36Z",
5+
"published": "2025-06-28T18:32:36Z",
6+
"aliases": [
7+
"CVE-2023-28906"
8+
],
9+
"details": "A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privileges and obtain administrative access to the system.\nThe vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28906"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-78"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-06-28T16:15:22Z"
43+
}
44+
}

‎advisories/unreviewed/2025/06/GHSA-5jg2-cjvx-wcpp/GHSA-5jg2-cjvx-wcpp.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5jg2-cjvx-wcpp",
4+
"modified": "2025-06-28T18:32:36Z",
5+
"published": "2025-06-28T18:32:36Z",
6+
"aliases": [
7+
"CVE-2023-28907"
8+
],
9+
"details": "There is no memory isolation between CPU cores of the MIB3 infotainment. This fact allows an attacker with access to the main operating system to compromise the CPU core responsible for CAN message processing.\nThe vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28907"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-284"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-06-28T16:15:22Z"
43+
}
44+
}

‎advisories/unreviewed/2025/06/GHSA-5qmq-gv7w-45x3/GHSA-5qmq-gv7w-45x3.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5qmq-gv7w-45x3",
4+
"modified": "2025-06-28T18:32:36Z",
5+
"published": "2025-06-28T18:32:36Z",
6+
"aliases": [
7+
"CVE-2023-28902"
8+
],
9+
"details": "An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-service of the infotainment system.\nThe vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28902"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-191"
38+
],
39+
"severity": "LOW",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-06-28T16:15:21Z"
43+
}
44+
}

‎advisories/unreviewed/2025/06/GHSA-679c-h9qm-hc7x/GHSA-679c-h9qm-hc7x.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-679c-h9qm-hc7x",
4+
"modified": "2025-06-28T18:32:36Z",
5+
"published": "2025-06-28T18:32:36Z",
6+
"aliases": [
7+
"CVE-2023-28905"
8+
],
9+
"details": "A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it.\nThe vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28905"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-122"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-06-28T16:15:22Z"
43+
}
44+
}

‎advisories/unreviewed/2025/06/GHSA-7w84-g65j-5mx7/GHSA-7w84-g65j-5mx7.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7w84-g65j-5mx7",
4+
"modified": "2025-06-28T18:32:36Z",
5+
"published": "2025-06-28T18:32:36Z",
6+
"aliases": [
7+
"CVE-2023-28903"
8+
],
9+
"details": "An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause a denial-of-service of the infotainment system.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28903"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-190"
38+
],
39+
"severity": "LOW",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-06-28T16:15:22Z"
43+
}
44+
}

‎advisories/unreviewed/2025/06/GHSA-938m-532f-x65h/GHSA-938m-532f-x65h.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-938m-532f-x65h",
4+
"modified": "2025-06-28T18:32:37Z",
5+
"published": "2025-06-28T18:32:37Z",
6+
"aliases": [
7+
"CVE-2023-29113"
8+
],
9+
"details": "The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication mechanism, leaving attackers with presence in the system an ability to undermine access control restrictions implemented at the operating system level.\nThe vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29113"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-284"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-06-28T16:15:23Z"
43+
}
44+
}

‎advisories/unreviewed/2025/06/GHSA-f8q6-g9q8-wm72/GHSA-f8q6-g9q8-wm72.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f8q6-g9q8-wm72",
4+
"modified": "2025-06-28T18:32:37Z",
5+
"published": "2025-06-28T18:32:37Z",
6+
"aliases": [
7+
"CVE-2025-6819"
8+
],
9+
"details": "A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /php_action/removeBrand.php. The manipulation of the argument brandId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6819"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/AlbaDove/cve/issues/2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.314257"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.314257"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.602609"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-06-28T17:15:24Z"
55+
}
56+
}

‎advisories/unreviewed/2025/06/GHSA-fj49-5pv6-cpp5/GHSA-fj49-5pv6-cpp5.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fj49-5pv6-cpp5",
4+
"modified": "2025-06-28T18:32:37Z",
5+
"published": "2025-06-28T18:32:36Z",
6+
"aliases": [
7+
"CVE-2023-28910"
8+
],
9+
"details": "A specific flaw exists within the Bluetooth stack of the MIB3 infotainment system. The issue results from the disabled abortion flag eventually leading to bypassing assertion functions.\nThe vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28910"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://asrg.io/security-advisories/vulnerabilities-in-volkswagen-mib3-infotainment-part-2"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://i.blackhat.com/EU-24/Presentations/EU-24-Parnishchev-OverTheAirVW.pdf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://pcacybersecurity.com/resources/advisory/vulnerabilities-in-vw-mib3-infotainment-2"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-754"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-06-28T16:15:23Z"
43+
}
44+
}

0 commit comments

Comments
 (0)