Refine your search

4 vulnerabilities found for forest by rymcu

CVE-2025-12925 (GCVE-0-2025-12925)
Vulnerability from nvd
Published
2025-11-10 01:32
Modified
2025-11-10 01:32
CWE
Summary
A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic of the file src/main/java/com/rymcu/forest/lucene/api/UserDicController.java. The manipulation results in missing authorization. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.
References
https://vuldb.com/?id.331645 vdb-entry, technical-description
https://vuldb.com/?ctiid.331645 signature, permissions-required
https://vuldb.com/?submit.681080 third-party-advisory
https://github.com/rymcu/forest/issues/199 issue-tracking
Impacted products
Vendor Product Version
rymcu forest Version: de53ce79db9faa2efc4e79ce1077a302c42a1224
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "forest",
          "vendor": "rymcu",
          "versions": [
            {
              "status": "affected",
              "version": "de53ce79db9faa2efc4e79ce1077a302c42a1224"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1098024193 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic of the file src/main/java/com/rymcu/forest/lucene/api/UserDicController.java. The manipulation results in missing authorization. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases."
        },
        {
          "lang": "de",
          "value": "Es wurde eine Schwachstelle in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224 entdeckt. Dabei geht es um die Funktion getAll/addDic/getAllDic/deleteDic der Datei src/main/java/com/rymcu/forest/lucene/api/UserDicController.java. Die Bearbeitung verursacht missing authorization. Der Angriff l\u00e4sst sich \u00fcber das Netzwerk starten. Dieses Produkt setzt Rolling Releases ein. Aus diesem Grund sind Details zu betroffenen oder zu aktualisierende Versionen nicht verf\u00fcgbar."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-10T01:32:06.970Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-331645 | rymcu forest UserDicController.java deleteDic authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.331645"
        },
        {
          "name": "VDB-331645 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.331645"
        },
        {
          "name": "Submit #681080 | RYMCU forest V1.0 Missing Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.681080"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/rymcu/forest/issues/199"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-11-09T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-11-09T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-11-09T07:59:00.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "rymcu forest UserDicController.java deleteDic authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-12925",
    "datePublished": "2025-11-10T01:32:06.970Z",
    "dateReserved": "2025-11-09T06:53:53.615Z",
    "dateUpdated": "2025-11-10T01:32:06.970Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12924 (GCVE-0-2025-12924)
Vulnerability from nvd
Published
2025-11-10 01:02
Modified
2025-11-10 01:02
CWE
Summary
A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The manipulation leads to missing authorization. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.
References
https://vuldb.com/?id.331644 vdb-entry, technical-description
https://vuldb.com/?ctiid.331644 signature, permissions-required
https://vuldb.com/?submit.681079 third-party-advisory
https://github.com/rymcu/forest/issues/198 issue-tracking
Impacted products
Vendor Product Version
rymcu forest Version: de53ce79db9faa2efc4e79ce1077a302c42a1224
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "forest",
          "vendor": "rymcu",
          "versions": [
            {
              "status": "affected",
              "version": "de53ce79db9faa2efc4e79ce1077a302c42a1224"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1098024193 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The manipulation leads to missing authorization. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available."
        },
        {
          "lang": "de",
          "value": "Eine Schwachstelle wurde in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224 gefunden. Es geht dabei um die Funktion GlobalResult der Datei src/main/java/com/rymcu/forest/web/api/bank/BankController.java. Die Ver\u00e4nderung resultiert in missing authorization. Der Angriff kann \u00fcber das Netzwerk passieren. Dieses Produkt verzichtet auf eine Versionierung und verwendet stattdessen Rolling Releases. Deshalb sind keine Details zu betroffenen oder zu aktualisierende Versionen vorhanden."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-10T01:02:05.888Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-331644 | rymcu forest BankController.java GlobalResult authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.331644"
        },
        {
          "name": "VDB-331644 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.331644"
        },
        {
          "name": "Submit #681079 | RYMCU forest V1.0 Missing Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.681079"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/rymcu/forest/issues/198"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-11-09T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-11-09T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-11-09T07:58:58.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "rymcu forest BankController.java GlobalResult authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-12924",
    "datePublished": "2025-11-10T01:02:05.888Z",
    "dateReserved": "2025-11-09T06:53:43.934Z",
    "dateUpdated": "2025-11-10T01:02:05.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12925 (GCVE-0-2025-12925)
Vulnerability from cvelistv5
Published
2025-11-10 01:32
Modified
2025-11-10 01:32
CWE
Summary
A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic of the file src/main/java/com/rymcu/forest/lucene/api/UserDicController.java. The manipulation results in missing authorization. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.
References
https://vuldb.com/?id.331645 vdb-entry, technical-description
https://vuldb.com/?ctiid.331645 signature, permissions-required
https://vuldb.com/?submit.681080 third-party-advisory
https://github.com/rymcu/forest/issues/199 issue-tracking
Impacted products
Vendor Product Version
rymcu forest Version: de53ce79db9faa2efc4e79ce1077a302c42a1224
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "forest",
          "vendor": "rymcu",
          "versions": [
            {
              "status": "affected",
              "version": "de53ce79db9faa2efc4e79ce1077a302c42a1224"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1098024193 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic of the file src/main/java/com/rymcu/forest/lucene/api/UserDicController.java. The manipulation results in missing authorization. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases."
        },
        {
          "lang": "de",
          "value": "Es wurde eine Schwachstelle in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224 entdeckt. Dabei geht es um die Funktion getAll/addDic/getAllDic/deleteDic der Datei src/main/java/com/rymcu/forest/lucene/api/UserDicController.java. Die Bearbeitung verursacht missing authorization. Der Angriff l\u00e4sst sich \u00fcber das Netzwerk starten. Dieses Produkt setzt Rolling Releases ein. Aus diesem Grund sind Details zu betroffenen oder zu aktualisierende Versionen nicht verf\u00fcgbar."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-10T01:32:06.970Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-331645 | rymcu forest UserDicController.java deleteDic authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.331645"
        },
        {
          "name": "VDB-331645 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.331645"
        },
        {
          "name": "Submit #681080 | RYMCU forest V1.0 Missing Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.681080"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/rymcu/forest/issues/199"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-11-09T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-11-09T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-11-09T07:59:00.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "rymcu forest UserDicController.java deleteDic authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-12925",
    "datePublished": "2025-11-10T01:32:06.970Z",
    "dateReserved": "2025-11-09T06:53:53.615Z",
    "dateUpdated": "2025-11-10T01:32:06.970Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12924 (GCVE-0-2025-12924)
Vulnerability from cvelistv5
Published
2025-11-10 01:02
Modified
2025-11-10 01:02
CWE
Summary
A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The manipulation leads to missing authorization. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.
References
https://vuldb.com/?id.331644 vdb-entry, technical-description
https://vuldb.com/?ctiid.331644 signature, permissions-required
https://vuldb.com/?submit.681079 third-party-advisory
https://github.com/rymcu/forest/issues/198 issue-tracking
Impacted products
Vendor Product Version
rymcu forest Version: de53ce79db9faa2efc4e79ce1077a302c42a1224
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "forest",
          "vendor": "rymcu",
          "versions": [
            {
              "status": "affected",
              "version": "de53ce79db9faa2efc4e79ce1077a302c42a1224"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1098024193 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The manipulation leads to missing authorization. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available."
        },
        {
          "lang": "de",
          "value": "Eine Schwachstelle wurde in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224 gefunden. Es geht dabei um die Funktion GlobalResult der Datei src/main/java/com/rymcu/forest/web/api/bank/BankController.java. Die Ver\u00e4nderung resultiert in missing authorization. Der Angriff kann \u00fcber das Netzwerk passieren. Dieses Produkt verzichtet auf eine Versionierung und verwendet stattdessen Rolling Releases. Deshalb sind keine Details zu betroffenen oder zu aktualisierende Versionen vorhanden."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-10T01:02:05.888Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-331644 | rymcu forest BankController.java GlobalResult authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.331644"
        },
        {
          "name": "VDB-331644 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.331644"
        },
        {
          "name": "Submit #681079 | RYMCU forest V1.0 Missing Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.681079"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/rymcu/forest/issues/198"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-11-09T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-11-09T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-11-09T07:58:58.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "rymcu forest BankController.java GlobalResult authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-12924",
    "datePublished": "2025-11-10T01:02:05.888Z",
    "dateReserved": "2025-11-09T06:53:43.934Z",
    "dateUpdated": "2025-11-10T01:02:05.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}