NVD 披露 CVE-2025-62276 安全漏洞
2025 年 11 月 1 日，NVD 公开披露漏洞 CVE-2025-62276（严重度：medium）。该记录属于当日安全漏洞披露史，建议关注受影响产品与厂商修复公告，完整技术细节见 NVD 原始记录。
2025 年 11 月重大安全事件归档，按日分组回访。
2025 年 11 月 1 日，NVD 公开披露漏洞 CVE-2025-62276（严重度：medium）。该记录属于当日安全漏洞披露史，建议关注受影响产品与厂商修复公告，完整技术细节见 NVD 原始记录。
NVD 收录：The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the browser's cache.
NVD 收录：A vulnerability was determined in itsourcecode Online Loan Management System 1.0. This issue affects some unknown processing of the file /manage_borrower.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
2025-11-04，美国 CISA 将 CWP Control Web Panel 的 CVE-2025-48703（CWP Control Web Panel OS Command Injection Vulnerability）列入已知被利用漏洞目录（KEV），确认该漏洞已被在野利用，并要求美国联邦机构按期限完成修复。
NVD 收录：By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and from there, relay connections.
NVD 收录：Cursor is a code editor built for programming with AI. In versions and below, a vulnerability in the Cursor CLI Beta allowed an attacker to achieve remote code execution through the MCP (Model Context Protocol) server mechanism by uploading a malicious MCP configuration in .cursor/mcp.json file in a GitHub repository. Once a victim clones the project and opens it using Cursor CLI, the command to run the malicious MCP server is immediately executed without any warning, leading to potential code execution as soon as the command runs. This issue is fixed in version 2025.09.17-25b418f.
NVD 收录：Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask. This issue is fixed in version 0.5.7.
NVD 收录：A flaw was found in Red Hat Single Sign-On. This issue is an Open Redirect vulnerability that occurs during the logout process. The redirect_uri parameter associated with the openid-connect logout protocol does not properly validate the provided URL.
NVD 收录：Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page. (Chromium security severity: Low)
NVD 收录：A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_login of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.11 and 3.0.12 is recommended to address this issue. It is advisable to upgrade the affected component.
NVD 收录：A vulnerability has been found in OpenClinica Community Edition up to 3.12.2/3.13. Affected by this issue is some unknown functionality of the file /ImportCRFData?action=confirm of the component CRF Data Import. Such manipulation of the argument xml_file leads to xml injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
2025-11-10，美国 CISA 将 Samsung Mobile Devices 的 CVE-2025-21042（Samsung Mobile Devices Out-of-Bounds Write Vulnerability）列入已知被利用漏洞目录（KEV），确认该漏洞已被在野利用，并要求美国联邦机构按期限完成修复。
NVD 收录：In TEE EcDSA algorithm, there is a possible memory consistency issue. This could lead to generated incorrect signature results with low probability.
NVD 收录：An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to bypass ASLR.
2025-11-12，美国 CISA 将 Gladinet Triofox 的 CVE-2025-12480（Gladinet Triofox Improper Access Control Vulnerability）列入已知被利用漏洞目录（KEV），确认该漏洞已被在野利用，并要求美国联邦机构按期限完成修复。
NVD 收录：An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affected system. Refer to the 'Security Update for DSL Series Router' section on the ASUS Security Advisory for more information.
NVD 收录：Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
2025-11-14，美国 CISA 将 Fortinet FortiWeb 的 CVE-2025-64446（Fortinet FortiWeb Path Traversal Vulnerability）列入已知被利用漏洞目录（KEV），确认该漏洞已被在野利用，并要求美国联邦机构按期限完成修复。
NVD 收录：General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login.
NVD 收录：A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version r1945 is recommended to address this issue. Patch name: 334da1ea39cb12f6b6e98dd2f80bb033e0c7b845. It is advisable to upgrade the affected component.
NVD 收录：A vulnerability was determined in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /add_librarian.php. This manipulation of the argument Username causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
2025-11-18，美国 CISA 将 Fortinet FortiWeb 的 CVE-2025-58034（Fortinet FortiWeb OS Command Injection Vulnerability）列入已知被利用漏洞目录（KEV），确认该漏洞已被在野利用，并要求美国联邦机构按期限完成修复。
NVD 收录：Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
2025-11-19，美国 CISA 将 Google Chromium V8 的 CVE-2025-13223（Google Chromium V8 Type Confusion Vulnerability）列入已知被利用漏洞目录（KEV），确认该漏洞已被在野利用，并要求美国联邦机构按期限完成修复。
NVD 收录：DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user's device.
NVD 收录：A vulnerability was detected in freeprojectscodes Sports Club Management System 1.0. The affected element is an unknown function of the file /dashboard/admin/change_s_pwd.php. Performing manipulation of the argument login_id results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.
NVD 收录：A security flaw has been discovered in itsourcecode Online File Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=login. The manipulation of the argument Username results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be exploited.
2025-11-21，美国 CISA 将 Oracle Fusion Middleware 的 CVE-2025-61757（Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability）列入已知被利用漏洞目录（KEV），确认该漏洞已被在野利用，并要求美国联邦机构按期限完成修复。
2025 年 11 月 22 日，NVD 公开披露漏洞 CVE-2025-12889（严重度：medium）。该记录属于当日安全漏洞披露史，建议关注受影响产品与厂商修复公告，完整技术细节见 NVD 原始记录。
NVD 收录：With TLS 1.2 connections a client can use any digest, specifically a weaker digest that is supported, rather than those in the CertificateRequest.
NVD 收录：A weakness has been identified in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected is an unknown function of the file /customer_register.php. Executing manipulation can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
NVD 收录：New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.9.6, a recently patched SSRF vulnerability contains a bypass method that can bypass the existing security fix and still allow SSRF to occur. Because the existing fix only applies security restrictions to the first URL request, a 302 redirect can bypass existing security measures and successfully access the intranet. This issue has been patched in version 0.9.6.
NVD 收录：Formwork is a flat file-based Content Management System (CMS). Prior to version 2.2.0, inserting unsanitized data into the blog tag field results in stored cross‑site scripting (XSS). Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. The issue is persistent and impacts privileged administrative workflows. This issue has been patched in version 2.2.0.
NVD 收录：Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2.
2025-11-28，美国 CISA 将 OpenPLC ScadaBR 的 CVE-2021-26829（OpenPLC ScadaBR Cross-site Scripting Vulnerability）列入已知被利用漏洞目录（KEV），确认该漏洞已被在野利用，并要求美国联邦机构按期限完成修复。
NVD 收录：An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scripting (XSS) vulnerability.
NVD 收录：Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended. This issue has been patched in versions 1.16.17, 1.17.10, and 1.18.4. There are no workarounds for this issue.
NVD 收录：The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 4.78. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if the 'registration password fields' enabled in theme options.
史料来源与许可：部分史料来自维基百科（CC BY-SA 4.0）、DBpedia（CC BY-SA 3.0）、NVD 与 CISA 公开数据，遵循各自许可；原文链接见条目来源。