diff --git a/advisories/unreviewed/2024/04/GHSA-9576-cchc-4f79/GHSA-9576-cchc-4f79.json b/advisories/unreviewed/2024/04/GHSA-9576-cchc-4f79/GHSA-9576-cchc-4f79.json index c9e30e68913..b8094c39c20 100644 --- a/advisories/unreviewed/2024/04/GHSA-9576-cchc-4f79/GHSA-9576-cchc-4f79.json +++ b/advisories/unreviewed/2024/04/GHSA-9576-cchc-4f79/GHSA-9576-cchc-4f79.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/11/GHSA-c75m-w45q-rj2j/GHSA-c75m-w45q-rj2j.json b/advisories/unreviewed/2024/11/GHSA-c75m-w45q-rj2j/GHSA-c75m-w45q-rj2j.json index d4685a684be..041eaf425eb 100644 --- a/advisories/unreviewed/2024/11/GHSA-c75m-w45q-rj2j/GHSA-c75m-w45q-rj2j.json +++ b/advisories/unreviewed/2024/11/GHSA-c75m-w45q-rj2j/GHSA-c75m-w45q-rj2j.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/11/GHSA-w4vv-pf24-vw92/GHSA-w4vv-pf24-vw92.json b/advisories/unreviewed/2024/11/GHSA-w4vv-pf24-vw92/GHSA-w4vv-pf24-vw92.json index 017bd76c5a7..69baa698c13 100644 --- a/advisories/unreviewed/2024/11/GHSA-w4vv-pf24-vw92/GHSA-w4vv-pf24-vw92.json +++ b/advisories/unreviewed/2024/11/GHSA-w4vv-pf24-vw92/GHSA-w4vv-pf24-vw92.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/03/GHSA-g8qj-jv5h-78cp/GHSA-g8qj-jv5h-78cp.json b/advisories/unreviewed/2025/03/GHSA-g8qj-jv5h-78cp/GHSA-g8qj-jv5h-78cp.json index beb18fefc00..70b641702c3 100644 --- a/advisories/unreviewed/2025/03/GHSA-g8qj-jv5h-78cp/GHSA-g8qj-jv5h-78cp.json +++ b/advisories/unreviewed/2025/03/GHSA-g8qj-jv5h-78cp/GHSA-g8qj-jv5h-78cp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g8qj-jv5h-78cp", - "modified": "2025-05-06T18:30:36Z", + "modified": "2025-05-07T00:31:34Z", "published": "2025-03-11T15:31:00Z", "aliases": [ "CVE-2025-27363" @@ -70,6 +70,10 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/03/14/4" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/05/06/3" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/05/GHSA-267q-f3g2-2vj4/GHSA-267q-f3g2-2vj4.json b/advisories/unreviewed/2025/05/GHSA-267q-f3g2-2vj4/GHSA-267q-f3g2-2vj4.json new file mode 100644 index 00000000000..0430cf44a1b --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-267q-f3g2-2vj4/GHSA-267q-f3g2-2vj4.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-267q-f3g2-2vj4", + "modified": "2025-05-07T00:31:34Z", + "published": "2025-05-07T00:31:34Z", + "aliases": [ + "CVE-2025-0853" + ], + "details": "The PGS Core plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'save_header_builder' function in all versions up to, and including, 5.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0853" + }, + { + "type": "WEB", + "url": "https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/changelog" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca41c951-318f-47a7-9a30-c1d4eea1b1b5?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-06T22:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-2vq3-r375-cjhg/GHSA-2vq3-r375-cjhg.json b/advisories/unreviewed/2025/05/GHSA-2vq3-r375-cjhg/GHSA-2vq3-r375-cjhg.json new file mode 100644 index 00000000000..f9cb789925d --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-2vq3-r375-cjhg/GHSA-2vq3-r375-cjhg.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2vq3-r375-cjhg", + "modified": "2025-05-07T00:31:34Z", + "published": "2025-05-07T00:31:34Z", + "aliases": [ + "CVE-2025-4372" + ], + "details": "Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4372" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/412057896" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-06T22:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-5cr4-86qx-f59h/GHSA-5cr4-86qx-f59h.json b/advisories/unreviewed/2025/05/GHSA-5cr4-86qx-f59h/GHSA-5cr4-86qx-f59h.json new file mode 100644 index 00000000000..38aa9f91165 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-5cr4-86qx-f59h/GHSA-5cr4-86qx-f59h.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5cr4-86qx-f59h", + "modified": "2025-05-07T00:31:34Z", + "published": "2025-05-07T00:31:34Z", + "aliases": [ + "CVE-2025-47420" + ], + "details": "266 vulnerability in Crestron Automate VX allows Privilege Escalation.This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47420" + }, + { + "type": "WEB", + "url": "https://security.crestron.com" + }, + { + "type": "WEB", + "url": "https://www.crestron.com/Software-Firmware/Software/Automate-VX-Software/6-4-1-8" + }, + { + "type": "WEB", + "url": "https://www.crestron.com/release_notes/automate_vx_6.4.1.8_release_notes.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-06T22:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-jpqq-22mr-fmc5/GHSA-jpqq-22mr-fmc5.json b/advisories/unreviewed/2025/05/GHSA-jpqq-22mr-fmc5/GHSA-jpqq-22mr-fmc5.json new file mode 100644 index 00000000000..4b989e0cf3d --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-jpqq-22mr-fmc5/GHSA-jpqq-22mr-fmc5.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jpqq-22mr-fmc5", + "modified": "2025-05-07T00:31:34Z", + "published": "2025-05-07T00:31:34Z", + "aliases": [ + "CVE-2025-0856" + ], + "details": "The PGS Core plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.8.0. This makes it possible for unauthenticated attackers to add, modify, or plugin options.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0856" + }, + { + "type": "WEB", + "url": "https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/changelog" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c33b1cb-6eb1-48cd-b706-5ec270f4ae7e?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-06T23:15:51Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-r822-jq42-473c/GHSA-r822-jq42-473c.json b/advisories/unreviewed/2025/05/GHSA-r822-jq42-473c/GHSA-r822-jq42-473c.json new file mode 100644 index 00000000000..85cfa32a7b3 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-r822-jq42-473c/GHSA-r822-jq42-473c.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r822-jq42-473c", + "modified": "2025-05-07T00:31:34Z", + "published": "2025-05-07T00:31:34Z", + "aliases": [ + "CVE-2025-0855" + ], + "details": "The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.8.0 via deserialization of untrusted input in the 'import_header' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0855" + }, + { + "type": "WEB", + "url": "https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/changelog" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5dfc2249-3761-49c6-966e-73c33be74c0e?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-06T23:15:50Z" + } +} \ No newline at end of file