netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-9576-cchc-4f79
GHSA-c75m-w45q-rj2j
GHSA-w4vv-pf24-vw92
GHSA-g8qj-jv5h-78cp
GHSA-267q-f3g2-2vj4
GHSA-2vq3-r375-cjhg
GHSA-5cr4-86qx-f59h
GHSA-jpqq-22mr-fmc5
GHSA-r822-jq42-473c
This commit is contained in:
advisory-database[bot]
2025-05-07 00:33:15 +00:00
parent 2fa3526637
commit 0ed59adea5
9 changed files with 213 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/04/GHSA-9576-cchc-4f79/GHSA-9576-cchc-4f79.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2024/11/GHSA-c75m-w45q-rj2j/GHSA-c75m-w45q-rj2j.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2024/11/GHSA-w4vv-pf24-vw92/GHSA-w4vv-pf24-vw92.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2025/03/GHSA-g8qj-jv5h-78cp/GHSA-g8qj-jv5h-78cp.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g8qj-jv5h-78cp",
"modified": "2025-05-06T18:30:36Z",
"modified": "2025-05-07T00:31:34Z",
"published": "2025-03-11T15:31:00Z",
"aliases": [
"CVE-2025-27363"
@@ -70,6 +70,10 @@
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/03/14/4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/05/06/3"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-267q-f3g2-2vj4/GHSA-267q-f3g2-2vj4.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-267q-f3g2-2vj4",
"modified": "2025-05-07T00:31:34Z",
"published": "2025-05-07T00:31:34Z",
"aliases": [
"CVE-2025-0853"
],
"details": "The PGS Core plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'save_header_builder' function in all versions up to, and including, 5.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0853"
},
{
"type": "WEB",
"url": "https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/changelog"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca41c951-318f-47a7-9a30-c1d4eea1b1b5?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-06T22:15:16Z"
}
}
advisories/unreviewed/2025/05/GHSA-2vq3-r375-cjhg/GHSA-2vq3-r375-cjhg.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2vq3-r375-cjhg",
"modified": "2025-05-07T00:31:34Z",
"published": "2025-05-07T00:31:34Z",
"aliases": [
"CVE-2025-4372"
],
"details": "Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4372"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/412057896"
}
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-06T22:15:17Z"
}
}
advisories/unreviewed/2025/05/GHSA-5cr4-86qx-f59h/GHSA-5cr4-86qx-f59h.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5cr4-86qx-f59h",
"modified": "2025-05-07T00:31:34Z",
"published": "2025-05-07T00:31:34Z",
"aliases": [
"CVE-2025-47420"
],
"details": "266 vulnerability in Crestron Automate VX allows Privilege Escalation.This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47420"
},
{
"type": "WEB",
"url": "https://security.crestron.com"
},
{
"type": "WEB",
"url": "https://www.crestron.com/Software-Firmware/Software/Automate-VX-Software/6-4-1-8"
},
{
"type": "WEB",
"url": "https://www.crestron.com/release_notes/automate_vx_6.4.1.8_release_notes.pdf"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-06T22:15:17Z"
}
}
advisories/unreviewed/2025/05/GHSA-jpqq-22mr-fmc5/GHSA-jpqq-22mr-fmc5.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jpqq-22mr-fmc5",
"modified": "2025-05-07T00:31:34Z",
"published": "2025-05-07T00:31:34Z",
"aliases": [
"CVE-2025-0856"
],
"details": "The PGS Core plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.8.0. This makes it possible for unauthenticated attackers to add, modify, or plugin options.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0856"
},
{
"type": "WEB",
"url": "https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/changelog"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c33b1cb-6eb1-48cd-b706-5ec270f4ae7e?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-06T23:15:51Z"
}
}
advisories/unreviewed/2025/05/GHSA-r822-jq42-473c/GHSA-r822-jq42-473c.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r822-jq42-473c",
"modified": "2025-05-07T00:31:34Z",
"published": "2025-05-07T00:31:34Z",
"aliases": [
"CVE-2025-0855"
],
"details": "The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.8.0 via deserialization of untrusted input in the 'import_header' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0855"
},
{
"type": "WEB",
"url": "https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/changelog"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5dfc2249-3761-49c6-966e-73c33be74c0e?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-06T23:15:50Z"
}
}