From 0b92fc949020fda82bb877024e33a1c07f936de0 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 26 Mar 2025 18:32:14 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-56p6-qw3c-fq2g.json | 61 +++++++++++++++++++ .../GHSA-43rm-m793-9q62.json | 2 +- .../GHSA-c2r8-h7hq-477v.json | 2 +- .../GHSA-8ph5-68pq-3fm9.json | 9 ++- .../GHSA-v933-rrv9-44p3.json | 9 ++- .../GHSA-6qc3-m7rh-m254.json | 4 +- .../GHSA-g84p-hgf8-8vg5.json | 6 +- .../GHSA-jr6c-jc92-gv6c.json | 3 +- .../GHSA-r3fh-95rm-cx6p.json | 2 +- .../GHSA-vpjc-3v2r-p99w.json | 9 ++- .../GHSA-w4rj-xpvg-fx9q.json | 2 + .../GHSA-cwpg-8775-j56v.json | 3 +- .../GHSA-f78h-hr6r-68jw.json | 4 +- .../GHSA-p4c4-q4mg-52qh.json | 4 +- .../GHSA-c52j-w2rg-37q5.json | 4 +- .../GHSA-gcvf-qqcq-825h.json | 11 +++- .../GHSA-rfj8-v7wf-3hfc.json | 11 +++- .../GHSA-9mq7-wpm3-gv26.json | 2 +- .../GHSA-v5pv-v2xp-jjp2.json | 11 +++- .../GHSA-mjh6-hm62-6x3r.json | 11 +++- .../GHSA-47m3-cr54-pvmq.json | 2 +- .../GHSA-2p78-jppx-g4gp.json | 31 ++++++++++ .../GHSA-59v2-78g4-8w49.json | 31 ++++++++++ .../GHSA-84h6-29cg-37g9.json | 3 +- .../GHSA-g533-46g7-g2f9.json | 44 +++++++++++++ .../GHSA-gj83-pgx5-7vmx.json | 31 ++++++++++ .../GHSA-gjj3-8gx6-j9w7.json | 40 ++++++++++++ .../GHSA-hfqm-jfc6-rh2f.json | 38 ++++++++++++ .../GHSA-hvhr-9472-4fw9.json | 31 ++++++++++ .../GHSA-j46h-c723-q9rm.json | 2 +- .../GHSA-x4j2-c46q-7jp5.json | 4 +- .../GHSA-xxhc-h629-rhgx.json | 29 +++++++++ 32 files changed, 423 insertions(+), 33 deletions(-) create mode 100644 advisories/github-reviewed/2025/03/GHSA-56p6-qw3c-fq2g/GHSA-56p6-qw3c-fq2g.json create mode 100644 advisories/unreviewed/2025/03/GHSA-2p78-jppx-g4gp/GHSA-2p78-jppx-g4gp.json create mode 100644 advisories/unreviewed/2025/03/GHSA-59v2-78g4-8w49/GHSA-59v2-78g4-8w49.json create mode 100644 advisories/unreviewed/2025/03/GHSA-g533-46g7-g2f9/GHSA-g533-46g7-g2f9.json create mode 100644 advisories/unreviewed/2025/03/GHSA-gj83-pgx5-7vmx/GHSA-gj83-pgx5-7vmx.json create mode 100644 advisories/unreviewed/2025/03/GHSA-gjj3-8gx6-j9w7/GHSA-gjj3-8gx6-j9w7.json create mode 100644 advisories/unreviewed/2025/03/GHSA-hfqm-jfc6-rh2f/GHSA-hfqm-jfc6-rh2f.json create mode 100644 advisories/unreviewed/2025/03/GHSA-hvhr-9472-4fw9/GHSA-hvhr-9472-4fw9.json create mode 100644 advisories/unreviewed/2025/03/GHSA-xxhc-h629-rhgx/GHSA-xxhc-h629-rhgx.json diff --git a/advisories/github-reviewed/2025/03/GHSA-56p6-qw3c-fq2g/GHSA-56p6-qw3c-fq2g.json b/advisories/github-reviewed/2025/03/GHSA-56p6-qw3c-fq2g/GHSA-56p6-qw3c-fq2g.json new file mode 100644 index 00000000000..c98a29b6f0c --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-56p6-qw3c-fq2g/GHSA-56p6-qw3c-fq2g.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-56p6-qw3c-fq2g", + "modified": "2025-03-26T18:30:43Z", + "published": "2025-03-26T18:30:43Z", + "aliases": [ + "CVE-2025-30351" + ], + "summary": "Suspended Directus user can continue to use session token to access API", + "details": "### Summary\nSince the user status is not checked when verifying a session token a suspended user can use the token generated in session auth mode to access the API despite their status.\n\n### Details\nThere is a check missing in `verifySessionJWT` to verify that a user is actually still active and allowed to access the API. Right now one can extract the session token obtained by, e.g. login in to the app while still active and then, after the user has been suspended continue to use that token until it expires.\n\n### PoC\n* Create an active user\n* Log in with that user and note the session cookie\n* Suspend the user (and don't trigger an `/auth/refresh` call, as that invalidates the session\n* Access the API with `Authorization: Bearer `\n\n### Impact\nThis weakens the security of suspending users.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "directus" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.10.0" + }, + { + "fixed": "11.15.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/directus/directus/security/advisories/GHSA-56p6-qw3c-fq2g" + }, + { + "type": "WEB", + "url": "https://github.com/directus/directus/commit/ef179931c55b50c110feca8404901d5633940771" + }, + { + "type": "PACKAGE", + "url": "https://github.com/directus/directus" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-672" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-03-26T18:30:43Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/04/GHSA-43rm-m793-9q62/GHSA-43rm-m793-9q62.json b/advisories/unreviewed/2022/04/GHSA-43rm-m793-9q62/GHSA-43rm-m793-9q62.json index 9eaae72eb12..56b150c65aa 100644 --- a/advisories/unreviewed/2022/04/GHSA-43rm-m793-9q62/GHSA-43rm-m793-9q62.json +++ b/advisories/unreviewed/2022/04/GHSA-43rm-m793-9q62/GHSA-43rm-m793-9q62.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-43rm-m793-9q62", - "modified": "2022-04-14T00:00:27Z", + "modified": "2025-03-26T18:30:34Z", "published": "2022-04-08T00:00:23Z", "aliases": [ "CVE-2022-25338" diff --git a/advisories/unreviewed/2022/04/GHSA-c2r8-h7hq-477v/GHSA-c2r8-h7hq-477v.json b/advisories/unreviewed/2022/04/GHSA-c2r8-h7hq-477v/GHSA-c2r8-h7hq-477v.json index 7310892feaf..6c85b3e80c3 100644 --- a/advisories/unreviewed/2022/04/GHSA-c2r8-h7hq-477v/GHSA-c2r8-h7hq-477v.json +++ b/advisories/unreviewed/2022/04/GHSA-c2r8-h7hq-477v/GHSA-c2r8-h7hq-477v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c2r8-h7hq-477v", - "modified": "2022-04-16T00:01:30Z", + "modified": "2025-03-26T18:30:34Z", "published": "2022-04-08T00:00:23Z", "aliases": [ "CVE-2022-25339" diff --git a/advisories/unreviewed/2022/05/GHSA-8ph5-68pq-3fm9/GHSA-8ph5-68pq-3fm9.json b/advisories/unreviewed/2022/05/GHSA-8ph5-68pq-3fm9/GHSA-8ph5-68pq-3fm9.json index 8c1977fc2db..4894c7865d7 100644 --- a/advisories/unreviewed/2022/05/GHSA-8ph5-68pq-3fm9/GHSA-8ph5-68pq-3fm9.json +++ b/advisories/unreviewed/2022/05/GHSA-8ph5-68pq-3fm9/GHSA-8ph5-68pq-3fm9.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-8ph5-68pq-3fm9", - "modified": "2022-05-24T17:42:40Z", + "modified": "2025-03-26T18:30:33Z", "published": "2022-05-24T17:42:40Z", "aliases": [ "CVE-2020-36250" ], "details": "In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [], "references": [ { diff --git a/advisories/unreviewed/2022/05/GHSA-v933-rrv9-44p3/GHSA-v933-rrv9-44p3.json b/advisories/unreviewed/2022/05/GHSA-v933-rrv9-44p3/GHSA-v933-rrv9-44p3.json index 9bb5538609b..b4c8ecac371 100644 --- a/advisories/unreviewed/2022/05/GHSA-v933-rrv9-44p3/GHSA-v933-rrv9-44p3.json +++ b/advisories/unreviewed/2022/05/GHSA-v933-rrv9-44p3/GHSA-v933-rrv9-44p3.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-v933-rrv9-44p3", - "modified": "2022-05-24T17:42:40Z", + "modified": "2025-03-26T18:30:33Z", "published": "2022-05-24T17:42:40Z", "aliases": [ "CVE-2020-36248" ], "details": "The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this archive.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [], "references": [ { diff --git a/advisories/unreviewed/2023/02/GHSA-6qc3-m7rh-m254/GHSA-6qc3-m7rh-m254.json b/advisories/unreviewed/2023/02/GHSA-6qc3-m7rh-m254/GHSA-6qc3-m7rh-m254.json index a96b84a6c76..a7cfc73c8ea 100644 --- a/advisories/unreviewed/2023/02/GHSA-6qc3-m7rh-m254/GHSA-6qc3-m7rh-m254.json +++ b/advisories/unreviewed/2023/02/GHSA-6qc3-m7rh-m254/GHSA-6qc3-m7rh-m254.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-200" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2023/02/GHSA-g84p-hgf8-8vg5/GHSA-g84p-hgf8-8vg5.json b/advisories/unreviewed/2023/02/GHSA-g84p-hgf8-8vg5/GHSA-g84p-hgf8-8vg5.json index 0ac82d669a7..2e3ddea3f61 100644 --- a/advisories/unreviewed/2023/02/GHSA-g84p-hgf8-8vg5/GHSA-g84p-hgf8-8vg5.json +++ b/advisories/unreviewed/2023/02/GHSA-g84p-hgf8-8vg5/GHSA-g84p-hgf8-8vg5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g84p-hgf8-8vg5", - "modified": "2023-02-09T18:30:28Z", + "modified": "2025-03-26T18:30:35Z", "published": "2023-02-03T03:30:25Z", "aliases": [ "CVE-2022-47130" @@ -19,6 +19,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47130" }, + { + "type": "WEB", + "url": "https://github.com/OpenXP-Research/CVE-2022-47130" + }, { "type": "WEB", "url": "https://portswigger.net/web-security/csrf" diff --git a/advisories/unreviewed/2023/02/GHSA-jr6c-jc92-gv6c/GHSA-jr6c-jc92-gv6c.json b/advisories/unreviewed/2023/02/GHSA-jr6c-jc92-gv6c/GHSA-jr6c-jc92-gv6c.json index 3201ef832eb..28a148e09d4 100644 --- a/advisories/unreviewed/2023/02/GHSA-jr6c-jc92-gv6c/GHSA-jr6c-jc92-gv6c.json +++ b/advisories/unreviewed/2023/02/GHSA-jr6c-jc92-gv6c/GHSA-jr6c-jc92-gv6c.json @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-77" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/02/GHSA-r3fh-95rm-cx6p/GHSA-r3fh-95rm-cx6p.json b/advisories/unreviewed/2023/02/GHSA-r3fh-95rm-cx6p/GHSA-r3fh-95rm-cx6p.json index d31c64d95d1..26d5c26f9e1 100644 --- a/advisories/unreviewed/2023/02/GHSA-r3fh-95rm-cx6p/GHSA-r3fh-95rm-cx6p.json +++ b/advisories/unreviewed/2023/02/GHSA-r3fh-95rm-cx6p/GHSA-r3fh-95rm-cx6p.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-r3fh-95rm-cx6p", - "modified": "2023-02-15T00:30:38Z", + "modified": "2025-03-26T18:30:42Z", "published": "2023-02-06T15:30:23Z", "aliases": [ "CVE-2022-48019" diff --git a/advisories/unreviewed/2023/02/GHSA-vpjc-3v2r-p99w/GHSA-vpjc-3v2r-p99w.json b/advisories/unreviewed/2023/02/GHSA-vpjc-3v2r-p99w/GHSA-vpjc-3v2r-p99w.json index 6326727d9ea..e6e4032160d 100644 --- a/advisories/unreviewed/2023/02/GHSA-vpjc-3v2r-p99w/GHSA-vpjc-3v2r-p99w.json +++ b/advisories/unreviewed/2023/02/GHSA-vpjc-3v2r-p99w/GHSA-vpjc-3v2r-p99w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vpjc-3v2r-p99w", - "modified": "2023-02-09T18:30:28Z", + "modified": "2025-03-26T18:30:35Z", "published": "2023-02-03T03:30:25Z", "aliases": [ "CVE-2022-47131" @@ -23,6 +23,10 @@ "type": "WEB", "url": "https://blog.hackingforce.com.br/en/xss" }, + { + "type": "WEB", + "url": "https://github.com/OpenXP-Research/CVE-2022-47131" + }, { "type": "WEB", "url": "https://portswigger.net/web-security/csrf" @@ -42,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-352" + "CWE-352", + "CWE-79" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/02/GHSA-w4rj-xpvg-fx9q/GHSA-w4rj-xpvg-fx9q.json b/advisories/unreviewed/2023/02/GHSA-w4rj-xpvg-fx9q/GHSA-w4rj-xpvg-fx9q.json index cc19e5c03ae..131bdb39502 100644 --- a/advisories/unreviewed/2023/02/GHSA-w4rj-xpvg-fx9q/GHSA-w4rj-xpvg-fx9q.json +++ b/advisories/unreviewed/2023/02/GHSA-w4rj-xpvg-fx9q/GHSA-w4rj-xpvg-fx9q.json @@ -26,6 +26,8 @@ ], "database_specific": { "cwe_ids": [ + "CWE-306", + "CWE-352", "CWE-863" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2024/02/GHSA-cwpg-8775-j56v/GHSA-cwpg-8775-j56v.json b/advisories/unreviewed/2024/02/GHSA-cwpg-8775-j56v/GHSA-cwpg-8775-j56v.json index 344a3b435c6..ddb5c8e75a7 100644 --- a/advisories/unreviewed/2024/02/GHSA-cwpg-8775-j56v/GHSA-cwpg-8775-j56v.json +++ b/advisories/unreviewed/2024/02/GHSA-cwpg-8775-j56v/GHSA-cwpg-8775-j56v.json @@ -30,7 +30,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-125" + "CWE-125", + "CWE-126" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/02/GHSA-f78h-hr6r-68jw/GHSA-f78h-hr6r-68jw.json b/advisories/unreviewed/2024/02/GHSA-f78h-hr6r-68jw/GHSA-f78h-hr6r-68jw.json index 3b67b21bd97..c04cf3afe40 100644 --- a/advisories/unreviewed/2024/02/GHSA-f78h-hr6r-68jw/GHSA-f78h-hr6r-68jw.json +++ b/advisories/unreviewed/2024/02/GHSA-f78h-hr6r-68jw/GHSA-f78h-hr6r-68jw.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-307" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/02/GHSA-p4c4-q4mg-52qh/GHSA-p4c4-q4mg-52qh.json b/advisories/unreviewed/2024/02/GHSA-p4c4-q4mg-52qh/GHSA-p4c4-q4mg-52qh.json index bc7312cb6c4..9b0aad902a3 100644 --- a/advisories/unreviewed/2024/02/GHSA-p4c4-q4mg-52qh/GHSA-p4c4-q4mg-52qh.json +++ b/advisories/unreviewed/2024/02/GHSA-p4c4-q4mg-52qh/GHSA-p4c4-q4mg-52qh.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-352" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/03/GHSA-c52j-w2rg-37q5/GHSA-c52j-w2rg-37q5.json b/advisories/unreviewed/2024/03/GHSA-c52j-w2rg-37q5/GHSA-c52j-w2rg-37q5.json index 41e8910d130..dd66e648208 100644 --- a/advisories/unreviewed/2024/03/GHSA-c52j-w2rg-37q5/GHSA-c52j-w2rg-37q5.json +++ b/advisories/unreviewed/2024/03/GHSA-c52j-w2rg-37q5/GHSA-c52j-w2rg-37q5.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-200" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-gcvf-qqcq-825h/GHSA-gcvf-qqcq-825h.json b/advisories/unreviewed/2024/04/GHSA-gcvf-qqcq-825h/GHSA-gcvf-qqcq-825h.json index f9435bdbba2..95d6247b2f2 100644 --- a/advisories/unreviewed/2024/04/GHSA-gcvf-qqcq-825h/GHSA-gcvf-qqcq-825h.json +++ b/advisories/unreviewed/2024/04/GHSA-gcvf-qqcq-825h/GHSA-gcvf-qqcq-825h.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-gcvf-qqcq-825h", - "modified": "2024-04-11T06:30:34Z", + "modified": "2025-03-26T18:30:44Z", "published": "2024-04-09T00:30:41Z", "aliases": [ "CVE-2024-27632" ], "details": "An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -27,7 +32,7 @@ "cwe_ids": [ "CWE-335" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-08T22:15:08Z" diff --git a/advisories/unreviewed/2024/04/GHSA-rfj8-v7wf-3hfc/GHSA-rfj8-v7wf-3hfc.json b/advisories/unreviewed/2024/04/GHSA-rfj8-v7wf-3hfc/GHSA-rfj8-v7wf-3hfc.json index daf1f32cef2..9ec9674e190 100644 --- a/advisories/unreviewed/2024/04/GHSA-rfj8-v7wf-3hfc/GHSA-rfj8-v7wf-3hfc.json +++ b/advisories/unreviewed/2024/04/GHSA-rfj8-v7wf-3hfc/GHSA-rfj8-v7wf-3hfc.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-rfj8-v7wf-3hfc", - "modified": "2024-04-03T06:30:48Z", + "modified": "2025-03-26T18:30:43Z", "published": "2024-04-03T06:30:48Z", "aliases": [ "CVE-2024-2322" ], "details": "The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -21,7 +26,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-03T05:15:47Z" diff --git a/advisories/unreviewed/2024/05/GHSA-9mq7-wpm3-gv26/GHSA-9mq7-wpm3-gv26.json b/advisories/unreviewed/2024/05/GHSA-9mq7-wpm3-gv26/GHSA-9mq7-wpm3-gv26.json index 44ac5338982..82b16b5acf8 100644 --- a/advisories/unreviewed/2024/05/GHSA-9mq7-wpm3-gv26/GHSA-9mq7-wpm3-gv26.json +++ b/advisories/unreviewed/2024/05/GHSA-9mq7-wpm3-gv26/GHSA-9mq7-wpm3-gv26.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9mq7-wpm3-gv26", - "modified": "2025-03-01T03:30:51Z", + "modified": "2025-03-26T18:30:44Z", "published": "2024-05-21T18:31:23Z", "aliases": [ "CVE-2024-22273" diff --git a/advisories/unreviewed/2024/05/GHSA-v5pv-v2xp-jjp2/GHSA-v5pv-v2xp-jjp2.json b/advisories/unreviewed/2024/05/GHSA-v5pv-v2xp-jjp2/GHSA-v5pv-v2xp-jjp2.json index b5485e312f4..d6e29fbd7e5 100644 --- a/advisories/unreviewed/2024/05/GHSA-v5pv-v2xp-jjp2/GHSA-v5pv-v2xp-jjp2.json +++ b/advisories/unreviewed/2024/05/GHSA-v5pv-v2xp-jjp2/GHSA-v5pv-v2xp-jjp2.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-v5pv-v2xp-jjp2", - "modified": "2024-05-22T15:31:00Z", + "modified": "2025-03-26T18:30:44Z", "published": "2024-05-22T15:31:00Z", "aliases": [ "CVE-2024-35554" ], "details": "idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=del&dataType=newsWeb&dataTypeCN.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-05-22T14:15:09Z" diff --git a/advisories/unreviewed/2024/07/GHSA-mjh6-hm62-6x3r/GHSA-mjh6-hm62-6x3r.json b/advisories/unreviewed/2024/07/GHSA-mjh6-hm62-6x3r/GHSA-mjh6-hm62-6x3r.json index 2b7e656c80b..da50370fdf2 100644 --- a/advisories/unreviewed/2024/07/GHSA-mjh6-hm62-6x3r/GHSA-mjh6-hm62-6x3r.json +++ b/advisories/unreviewed/2024/07/GHSA-mjh6-hm62-6x3r/GHSA-mjh6-hm62-6x3r.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-mjh6-hm62-6x3r", - "modified": "2024-11-12T00:30:35Z", + "modified": "2025-03-26T18:30:45Z", "published": "2024-07-26T21:31:16Z", "aliases": [ "CVE-2024-40116" ], "details": "An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], "affected": [], "references": [ { @@ -27,7 +32,7 @@ "cwe_ids": [ "CWE-256" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-26T20:15:04Z" diff --git a/advisories/unreviewed/2025/02/GHSA-47m3-cr54-pvmq/GHSA-47m3-cr54-pvmq.json b/advisories/unreviewed/2025/02/GHSA-47m3-cr54-pvmq/GHSA-47m3-cr54-pvmq.json index 92001f82144..a41ebc529eb 100644 --- a/advisories/unreviewed/2025/02/GHSA-47m3-cr54-pvmq/GHSA-47m3-cr54-pvmq.json +++ b/advisories/unreviewed/2025/02/GHSA-47m3-cr54-pvmq/GHSA-47m3-cr54-pvmq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-47m3-cr54-pvmq", - "modified": "2025-02-28T09:30:55Z", + "modified": "2025-03-26T18:30:46Z", "published": "2025-02-28T09:30:55Z", "aliases": [ "CVE-2025-1413" diff --git a/advisories/unreviewed/2025/03/GHSA-2p78-jppx-g4gp/GHSA-2p78-jppx-g4gp.json b/advisories/unreviewed/2025/03/GHSA-2p78-jppx-g4gp/GHSA-2p78-jppx-g4gp.json new file mode 100644 index 00000000000..1824915c769 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-2p78-jppx-g4gp/GHSA-2p78-jppx-g4gp.json @@ -0,0 +1,31 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2p78-jppx-g4gp", + "modified": "2025-03-26T18:30:51Z", + "published": "2025-03-26T18:30:51Z", + "aliases": [ + "CVE-2025-2562" + ], + "details": "Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without generating a corresponding log event, via the use of the autotyping functionality.\n\n\n\n\n\n\n\nThis issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2562" + }, + { + "type": "WEB", + "url": "https://devolutions.net/security/advisories/DEVO-2025-0005" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-778" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-26T18:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-59v2-78g4-8w49/GHSA-59v2-78g4-8w49.json b/advisories/unreviewed/2025/03/GHSA-59v2-78g4-8w49/GHSA-59v2-78g4-8w49.json new file mode 100644 index 00000000000..cfc3daaef96 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-59v2-78g4-8w49/GHSA-59v2-78g4-8w49.json @@ -0,0 +1,31 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-59v2-78g4-8w49", + "modified": "2025-03-26T18:30:51Z", + "published": "2025-03-26T18:30:51Z", + "aliases": [ + "CVE-2025-2600" + ], + "details": "Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated password to use the ELEVATED_PASSWORD variable even though not allowed by the \"Allow password in variable policy\". \n\n\n\n\n\nThis issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2600" + }, + { + "type": "WEB", + "url": "https://devolutions.net/security/advisories/DEVO-2025-0005" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-26T18:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-84h6-29cg-37g9/GHSA-84h6-29cg-37g9.json b/advisories/unreviewed/2025/03/GHSA-84h6-29cg-37g9/GHSA-84h6-29cg-37g9.json index f8cc45104f5..aad916d2fb1 100644 --- a/advisories/unreviewed/2025/03/GHSA-84h6-29cg-37g9/GHSA-84h6-29cg-37g9.json +++ b/advisories/unreviewed/2025/03/GHSA-84h6-29cg-37g9/GHSA-84h6-29cg-37g9.json @@ -42,7 +42,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/03/GHSA-g533-46g7-g2f9/GHSA-g533-46g7-g2f9.json b/advisories/unreviewed/2025/03/GHSA-g533-46g7-g2f9/GHSA-g533-46g7-g2f9.json new file mode 100644 index 00000000000..e7f98a174d8 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-g533-46g7-g2f9/GHSA-g533-46g7-g2f9.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g533-46g7-g2f9", + "modified": "2025-03-26T18:30:50Z", + "published": "2025-03-26T18:30:50Z", + "aliases": [ + "CVE-2025-2825" + ], + "details": "CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that may result in unauthenticated access. Remote and unauthenticated HTTP requests to CrushFTP may allow attackers to gain unauthorized access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2825" + }, + { + "type": "WEB", + "url": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update" + }, + { + "type": "WEB", + "url": "https://www.rapid7.com/blog/post/2025/03/25/etr-notable-vulnerabilities-in-next-js-cve-2025-29927" + }, + { + "type": "WEB", + "url": "https://www.runzero.com/blog/crushftp" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-26T16:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-gj83-pgx5-7vmx/GHSA-gj83-pgx5-7vmx.json b/advisories/unreviewed/2025/03/GHSA-gj83-pgx5-7vmx/GHSA-gj83-pgx5-7vmx.json new file mode 100644 index 00000000000..a6c26bd41b3 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-gj83-pgx5-7vmx/GHSA-gj83-pgx5-7vmx.json @@ -0,0 +1,31 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gj83-pgx5-7vmx", + "modified": "2025-03-26T18:30:51Z", + "published": "2025-03-26T18:30:51Z", + "aliases": [ + "CVE-2025-2499" + ], + "details": "Client side access control bypass in the permission component in \nDevolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to bypass certain permission restrictions—specifically View Password, Edit Asset, and Edit Permissions by performing specific actions. \n\nThis issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2499" + }, + { + "type": "WEB", + "url": "https://devolutions.net/security/advisories/DEVO-2025-0005" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-26T18:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-gjj3-8gx6-j9w7/GHSA-gjj3-8gx6-j9w7.json b/advisories/unreviewed/2025/03/GHSA-gjj3-8gx6-j9w7/GHSA-gjj3-8gx6-j9w7.json new file mode 100644 index 00000000000..1fd597a2da1 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-gjj3-8gx6-j9w7/GHSA-gjj3-8gx6-j9w7.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gjj3-8gx6-j9w7", + "modified": "2025-03-26T18:30:50Z", + "published": "2025-03-26T18:30:49Z", + "aliases": [ + "CVE-2025-2098" + ], + "details": "Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects Fast CAD Reader in possibly all versions since the vendor has not responded to our messages. The tested version was 4.1.5", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2098" + }, + { + "type": "WEB", + "url": "https://apps.apple.com/pl/app/fast-cad-reader/id1484905765" + }, + { + "type": "WEB", + "url": "https://cert.pl/en/posts/2025/03/CVE-2025-2098" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-26T16:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-hfqm-jfc6-rh2f/GHSA-hfqm-jfc6-rh2f.json b/advisories/unreviewed/2025/03/GHSA-hfqm-jfc6-rh2f/GHSA-hfqm-jfc6-rh2f.json new file mode 100644 index 00000000000..83d1f735710 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-hfqm-jfc6-rh2f/GHSA-hfqm-jfc6-rh2f.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hfqm-jfc6-rh2f", + "modified": "2025-03-26T18:30:50Z", + "published": "2025-03-26T18:30:50Z", + "aliases": [ + "CVE-2025-2783" + ], + "details": "Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2783" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/405143032" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-26T16:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-hvhr-9472-4fw9/GHSA-hvhr-9472-4fw9.json b/advisories/unreviewed/2025/03/GHSA-hvhr-9472-4fw9/GHSA-hvhr-9472-4fw9.json new file mode 100644 index 00000000000..bd3b177e8e7 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-hvhr-9472-4fw9/GHSA-hvhr-9472-4fw9.json @@ -0,0 +1,31 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hvhr-9472-4fw9", + "modified": "2025-03-26T18:30:51Z", + "published": "2025-03-26T18:30:51Z", + "aliases": [ + "CVE-2025-2528" + ], + "details": "Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to \nuse a configuration different from the one mandated by the system administrators.\n\n\n\n\n\nThis issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2528" + }, + { + "type": "WEB", + "url": "https://devolutions.net/security/advisories/DEVO-2025-0005" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-26T18:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-j46h-c723-q9rm/GHSA-j46h-c723-q9rm.json b/advisories/unreviewed/2025/03/GHSA-j46h-c723-q9rm/GHSA-j46h-c723-q9rm.json index f5fc7196d80..dd336e40706 100644 --- a/advisories/unreviewed/2025/03/GHSA-j46h-c723-q9rm/GHSA-j46h-c723-q9rm.json +++ b/advisories/unreviewed/2025/03/GHSA-j46h-c723-q9rm/GHSA-j46h-c723-q9rm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j46h-c723-q9rm", - "modified": "2025-03-20T12:32:53Z", + "modified": "2025-03-26T18:30:49Z", "published": "2025-03-20T12:32:53Z", "aliases": [ "CVE-2025-1802" diff --git a/advisories/unreviewed/2025/03/GHSA-x4j2-c46q-7jp5/GHSA-x4j2-c46q-7jp5.json b/advisories/unreviewed/2025/03/GHSA-x4j2-c46q-7jp5/GHSA-x4j2-c46q-7jp5.json index 589d07726fe..64fb84cefed 100644 --- a/advisories/unreviewed/2025/03/GHSA-x4j2-c46q-7jp5/GHSA-x4j2-c46q-7jp5.json +++ b/advisories/unreviewed/2025/03/GHSA-x4j2-c46q-7jp5/GHSA-x4j2-c46q-7jp5.json @@ -41,7 +41,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-158" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/03/GHSA-xxhc-h629-rhgx/GHSA-xxhc-h629-rhgx.json b/advisories/unreviewed/2025/03/GHSA-xxhc-h629-rhgx/GHSA-xxhc-h629-rhgx.json new file mode 100644 index 00000000000..3c4a63df2de --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-xxhc-h629-rhgx/GHSA-xxhc-h629-rhgx.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xxhc-h629-rhgx", + "modified": "2025-03-26T18:30:50Z", + "published": "2025-03-26T18:30:50Z", + "aliases": [ + "CVE-2024-41643" + ], + "details": "An issue in Arris NVG443B 9.3.0h3d36 allows a physically proximate attacker to execute arbitrary code via the cshell login component.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41643" + }, + { + "type": "WEB", + "url": "https://gavpherk.github.io/GavinKelsey" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-26T18:15:24Z" + } +} \ No newline at end of file