netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-r3c3-f9mx-3phh
GHSA-4jxq-w8rh-485r
GHSA-5xxj-pf2m-pqvc
GHSA-798f-57rp-g3wf
GHSA-9373-29x4-fjwq
GHSA-99pw-j6hr-cv22
GHSA-9fmx-g36w-qhc9
GHSA-9hm7-j2jc-wh96
GHSA-9m2c-327v-gghq
GHSA-h6px-f78v-j5xj
GHSA-hvw5-4g4q-2h8p
GHSA-m6cq-73g8-w4jh
GHSA-p8m7-rwcv-mwmp
GHSA-r7jg-46x5-3627
GHSA-rvrw-q6hf-fq9h
GHSA-vq52-99r9-h5pw
This commit is contained in:
advisory-database[bot]
2025-02-11 06:32:13 +00:00
parent 67d8565754
commit 0a10c7b803
16 changed files with 445 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-r3c3-f9mx-3phh/GHSA-r3c3-f9mx-3phh.json
+6 -2
View File
@@ -1,12 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r3c3-f9mx-3phh",
"modified": "2024-02-13T03:30:20Z",
"modified": "2025-02-11T06:30:24Z",
"published": "2024-02-13T03:30:20Z",
"aliases": [
"CVE-2024-22126"
],
"details": "The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting (XSS) vulnerability, leading to a high impact on confidentiality and mild impact on integrity and availability.\n\n",
"details": "The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting (XSS) vulnerability, leading to a high impact on confidentiality and mild impact on integrity and availability.",
"severity": [
{
"type": "CVSS_V3",
@@ -23,6 +23,10 @@
"type": "WEB",
"url": "https://me.sap.com/notes/3417627"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3557138"
},
{
"type": "WEB",
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
advisories/unreviewed/2025/02/GHSA-4jxq-w8rh-485r/GHSA-4jxq-w8rh-485r.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4jxq-w8rh-485r",
"modified": "2025-02-11T03:30:56Z",
"modified": "2025-02-11T06:30:25Z",
"published": "2025-02-11T03:30:56Z",
"aliases": [
"CVE-2025-25241"
advisories/unreviewed/2025/02/GHSA-5xxj-pf2m-pqvc/GHSA-5xxj-pf2m-pqvc.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5xxj-pf2m-pqvc",
"modified": "2025-02-11T06:30:27Z",
"published": "2025-02-11T06:30:27Z",
"aliases": [
"CVE-2025-1177"
],
"details": "A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has been classified as critical. Affected is the function import_add of the file dayrui/Fcms/Control/Admin/Linkage.php. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1177"
},
{
"type": "WEB",
"url": "https://github.com/stevenchen0x01/CVE2/blob/main/cve2.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.295080"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.295080"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.495366"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-11T06:15:22Z"
}
}
advisories/unreviewed/2025/02/GHSA-798f-57rp-g3wf/GHSA-798f-57rp-g3wf.json
+2 -1
View File
@@ -42,7 +42,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-74"
"CWE-74",
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2025/02/GHSA-9373-29x4-fjwq/GHSA-9373-29x4-fjwq.json
+64
View File
@@ -0,0 +1,64 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9373-29x4-fjwq",
"modified": "2025-02-11T06:30:28Z",
"published": "2025-02-11T06:30:27Z",
"aliases": [
"CVE-2025-1176"
],
"details": "A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1176"
},
{
"type": "WEB",
"url": "https://sourceware.org/bugzilla/attachment.cgi?id=15913"
},
{
"type": "WEB",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32636"
},
{
"type": "WEB",
"url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f9978defb6fab0bd8583942d97c112b0932ac814"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.295079"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.295079"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.495329"
},
{
"type": "WEB",
"url": "https://www.gnu.org"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-11T06:15:22Z"
}
}
advisories/unreviewed/2025/02/GHSA-99pw-j6hr-cv22/GHSA-99pw-j6hr-cv22.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-99pw-j6hr-cv22",
"modified": "2025-02-11T06:30:27Z",
"published": "2025-02-11T06:30:27Z",
"aliases": [
"CVE-2025-1174"
],
"details": "A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file process_book_add.php of the component Add Book Page. The manipulation of the argument Book Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1174"
},
{
"type": "WEB",
"url": "https://github.com/NeoVuln/CVE/issues/3"
},
{
"type": "WEB",
"url": "https://1000projects.org"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.295078"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.295078"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.495318"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-11T05:15:13Z"
}
}
advisories/unreviewed/2025/02/GHSA-9fmx-g36w-qhc9/GHSA-9fmx-g36w-qhc9.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9fmx-g36w-qhc9",
"modified": "2025-02-11T06:30:27Z",
"published": "2025-02-11T06:30:27Z",
"aliases": [
"CVE-2024-13543"
],
"details": "The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13543"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/04a545c4-75d3-4672-8530-00bb879991ca"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-11T06:15:19Z"
}
}
advisories/unreviewed/2025/02/GHSA-9hm7-j2jc-wh96/GHSA-9hm7-j2jc-wh96.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9hm7-j2jc-wh96",
"modified": "2025-02-11T06:30:27Z",
"published": "2025-02-11T06:30:27Z",
"aliases": [
"CVE-2024-13570"
],
"details": "The Stray Random Quotes WordPress plugin through 1.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13570"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/26019036-f7e4-4ef5-85d4-7d5fda18823e"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-11T06:15:19Z"
}
}
advisories/unreviewed/2025/02/GHSA-9m2c-327v-gghq/GHSA-9m2c-327v-gghq.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9m2c-327v-gghq",
"modified": "2025-02-11T06:30:27Z",
"published": "2025-02-11T06:30:27Z",
"aliases": [
"CVE-2024-13544"
],
"details": "The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13544"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/91884263-62a7-436e-b19f-682b1aeb37d6"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-11T06:15:19Z"
}
}
advisories/unreviewed/2025/02/GHSA-h6px-f78v-j5xj/GHSA-h6px-f78v-j5xj.json
+2 -1
View File
@@ -38,7 +38,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-74"
"CWE-74",
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2025/02/GHSA-hvw5-4g4q-2h8p/GHSA-hvw5-4g4q-2h8p.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hvw5-4g4q-2h8p",
"modified": "2025-02-10T21:31:39Z",
"modified": "2025-02-11T06:30:24Z",
"published": "2025-02-10T21:31:39Z",
"aliases": [
"CVE-2025-24200"
@@ -21,6 +21,14 @@
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122174"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Feb/7"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Feb/8"
}
],
"database_specific": {
advisories/unreviewed/2025/02/GHSA-m6cq-73g8-w4jh/GHSA-m6cq-73g8-w4jh.json
+2 -1
View File
@@ -46,7 +46,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
"CWE-284",
"CWE-434"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2025/02/GHSA-p8m7-rwcv-mwmp/GHSA-p8m7-rwcv-mwmp.json
+57
View File
@@ -0,0 +1,57 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p8m7-rwcv-mwmp",
"modified": "2025-02-11T06:30:27Z",
"published": "2025-02-11T06:30:27Z",
"aliases": [
"CVE-2025-1173"
],
"details": "A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affects an unknown part of the file process_users_del.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1173"
},
{
"type": "WEB",
"url": "https://github.com/NeoVuln/CVE/issues/2"
},
{
"type": "WEB",
"url": "https://1000projects.org"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.295077"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.295077"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.495309"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74",
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-11T05:15:13Z"
}
}
advisories/unreviewed/2025/02/GHSA-r7jg-46x5-3627/GHSA-r7jg-46x5-3627.json
+57
View File
@@ -0,0 +1,57 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r7jg-46x5-3627",
"modified": "2025-02-11T06:30:27Z",
"published": "2025-02-11T06:30:27Z",
"aliases": [
"CVE-2025-1172"
],
"details": "A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affected by this issue is some unknown functionality of the file addtocart.php. The manipulation of the argument bcid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1172"
},
{
"type": "WEB",
"url": "https://github.com/NeoVuln/CVE/issues/1"
},
{
"type": "WEB",
"url": "https://1000projects.org"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.295076"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.295076"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.495183"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74",
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-11T04:15:08Z"
}
}
advisories/unreviewed/2025/02/GHSA-rvrw-q6hf-fq9h/GHSA-rvrw-q6hf-fq9h.json
+2 -1
View File
@@ -42,7 +42,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
"CWE-284",
"CWE-434"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2025/02/GHSA-vq52-99r9-h5pw/GHSA-vq52-99r9-h5pw.json
+48
View File
@@ -0,0 +1,48 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vq52-99r9-h5pw",
"modified": "2025-02-11T06:30:27Z",
"published": "2025-02-11T06:30:27Z",
"aliases": [
"CVE-2025-1211"
],
"details": "Versions of the package hackney from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://127.0.0.1?@127.2.2.2/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/. \nThis vulnerability can be exploited when users rely on the URL function for host checking.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1211"
},
{
"type": "WEB",
"url": "https://gist.github.com/snoopysecurity/996de09ec0cfd0ebdcfdda8ff515deb1"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-HEX-HACKNEY-6516131"
},
{
"type": "WEB",
"url": "https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf"
}
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-11T05:15:14Z"
}
}