From 0ed59adea5f37503396ed0938d10188274cc85b0 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 7 May 2025 00:33:15 +0000 Subject: [PATCH] Publish Advisories GHSA-9576-cchc-4f79 GHSA-c75m-w45q-rj2j GHSA-w4vv-pf24-vw92 GHSA-g8qj-jv5h-78cp GHSA-267q-f3g2-2vj4 GHSA-2vq3-r375-cjhg GHSA-5cr4-86qx-f59h GHSA-jpqq-22mr-fmc5 GHSA-r822-jq42-473c --- .../GHSA-9576-cchc-4f79.json | 4 +- .../GHSA-c75m-w45q-rj2j.json | 4 +- .../GHSA-w4vv-pf24-vw92.json | 4 +- .../GHSA-g8qj-jv5h-78cp.json | 6 ++- .../GHSA-267q-f3g2-2vj4.json | 40 +++++++++++++++++ .../GHSA-2vq3-r375-cjhg.json | 35 +++++++++++++++ .../GHSA-5cr4-86qx-f59h.json | 44 +++++++++++++++++++ .../GHSA-jpqq-22mr-fmc5.json | 40 +++++++++++++++++ .../GHSA-r822-jq42-473c.json | 40 +++++++++++++++++ 9 files changed, 213 insertions(+), 4 deletions(-) create mode 100644 advisories/unreviewed/2025/05/GHSA-267q-f3g2-2vj4/GHSA-267q-f3g2-2vj4.json create mode 100644 advisories/unreviewed/2025/05/GHSA-2vq3-r375-cjhg/GHSA-2vq3-r375-cjhg.json create mode 100644 advisories/unreviewed/2025/05/GHSA-5cr4-86qx-f59h/GHSA-5cr4-86qx-f59h.json create mode 100644 advisories/unreviewed/2025/05/GHSA-jpqq-22mr-fmc5/GHSA-jpqq-22mr-fmc5.json create mode 100644 advisories/unreviewed/2025/05/GHSA-r822-jq42-473c/GHSA-r822-jq42-473c.json diff --git a/advisories/unreviewed/2024/04/GHSA-9576-cchc-4f79/GHSA-9576-cchc-4f79.json b/advisories/unreviewed/2024/04/GHSA-9576-cchc-4f79/GHSA-9576-cchc-4f79.json index c9e30e68913..b8094c39c20 100644 --- a/advisories/unreviewed/2024/04/GHSA-9576-cchc-4f79/GHSA-9576-cchc-4f79.json +++ b/advisories/unreviewed/2024/04/GHSA-9576-cchc-4f79/GHSA-9576-cchc-4f79.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/11/GHSA-c75m-w45q-rj2j/GHSA-c75m-w45q-rj2j.json b/advisories/unreviewed/2024/11/GHSA-c75m-w45q-rj2j/GHSA-c75m-w45q-rj2j.json index d4685a684be..041eaf425eb 100644 --- a/advisories/unreviewed/2024/11/GHSA-c75m-w45q-rj2j/GHSA-c75m-w45q-rj2j.json +++ b/advisories/unreviewed/2024/11/GHSA-c75m-w45q-rj2j/GHSA-c75m-w45q-rj2j.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/11/GHSA-w4vv-pf24-vw92/GHSA-w4vv-pf24-vw92.json b/advisories/unreviewed/2024/11/GHSA-w4vv-pf24-vw92/GHSA-w4vv-pf24-vw92.json index 017bd76c5a7..69baa698c13 100644 --- a/advisories/unreviewed/2024/11/GHSA-w4vv-pf24-vw92/GHSA-w4vv-pf24-vw92.json +++ b/advisories/unreviewed/2024/11/GHSA-w4vv-pf24-vw92/GHSA-w4vv-pf24-vw92.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/03/GHSA-g8qj-jv5h-78cp/GHSA-g8qj-jv5h-78cp.json b/advisories/unreviewed/2025/03/GHSA-g8qj-jv5h-78cp/GHSA-g8qj-jv5h-78cp.json index beb18fefc00..70b641702c3 100644 --- a/advisories/unreviewed/2025/03/GHSA-g8qj-jv5h-78cp/GHSA-g8qj-jv5h-78cp.json +++ b/advisories/unreviewed/2025/03/GHSA-g8qj-jv5h-78cp/GHSA-g8qj-jv5h-78cp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g8qj-jv5h-78cp", - "modified": "2025-05-06T18:30:36Z", + "modified": "2025-05-07T00:31:34Z", "published": "2025-03-11T15:31:00Z", "aliases": [ "CVE-2025-27363" @@ -70,6 +70,10 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/03/14/4" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/05/06/3" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/05/GHSA-267q-f3g2-2vj4/GHSA-267q-f3g2-2vj4.json b/advisories/unreviewed/2025/05/GHSA-267q-f3g2-2vj4/GHSA-267q-f3g2-2vj4.json new file mode 100644 index 00000000000..0430cf44a1b --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-267q-f3g2-2vj4/GHSA-267q-f3g2-2vj4.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-267q-f3g2-2vj4", + "modified": "2025-05-07T00:31:34Z", + "published": "2025-05-07T00:31:34Z", + "aliases": [ + "CVE-2025-0853" + ], + "details": "The PGS Core plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'save_header_builder' function in all versions up to, and including, 5.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0853" + }, + { + "type": "WEB", + "url": "https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/changelog" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca41c951-318f-47a7-9a30-c1d4eea1b1b5?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-06T22:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-2vq3-r375-cjhg/GHSA-2vq3-r375-cjhg.json b/advisories/unreviewed/2025/05/GHSA-2vq3-r375-cjhg/GHSA-2vq3-r375-cjhg.json new file mode 100644 index 00000000000..f9cb789925d --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-2vq3-r375-cjhg/GHSA-2vq3-r375-cjhg.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2vq3-r375-cjhg", + "modified": "2025-05-07T00:31:34Z", + "published": "2025-05-07T00:31:34Z", + "aliases": [ + "CVE-2025-4372" + ], + "details": "Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4372" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/412057896" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-06T22:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-5cr4-86qx-f59h/GHSA-5cr4-86qx-f59h.json b/advisories/unreviewed/2025/05/GHSA-5cr4-86qx-f59h/GHSA-5cr4-86qx-f59h.json new file mode 100644 index 00000000000..38aa9f91165 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-5cr4-86qx-f59h/GHSA-5cr4-86qx-f59h.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5cr4-86qx-f59h", + "modified": "2025-05-07T00:31:34Z", + "published": "2025-05-07T00:31:34Z", + "aliases": [ + "CVE-2025-47420" + ], + "details": "266 vulnerability in Crestron Automate VX allows Privilege Escalation.This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47420" + }, + { + "type": "WEB", + "url": "https://security.crestron.com" + }, + { + "type": "WEB", + "url": "https://www.crestron.com/Software-Firmware/Software/Automate-VX-Software/6-4-1-8" + }, + { + "type": "WEB", + "url": "https://www.crestron.com/release_notes/automate_vx_6.4.1.8_release_notes.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-06T22:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-jpqq-22mr-fmc5/GHSA-jpqq-22mr-fmc5.json b/advisories/unreviewed/2025/05/GHSA-jpqq-22mr-fmc5/GHSA-jpqq-22mr-fmc5.json new file mode 100644 index 00000000000..4b989e0cf3d --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-jpqq-22mr-fmc5/GHSA-jpqq-22mr-fmc5.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jpqq-22mr-fmc5", + "modified": "2025-05-07T00:31:34Z", + "published": "2025-05-07T00:31:34Z", + "aliases": [ + "CVE-2025-0856" + ], + "details": "The PGS Core plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.8.0. This makes it possible for unauthenticated attackers to add, modify, or plugin options.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0856" + }, + { + "type": "WEB", + "url": "https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/changelog" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c33b1cb-6eb1-48cd-b706-5ec270f4ae7e?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-06T23:15:51Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-r822-jq42-473c/GHSA-r822-jq42-473c.json b/advisories/unreviewed/2025/05/GHSA-r822-jq42-473c/GHSA-r822-jq42-473c.json new file mode 100644 index 00000000000..85cfa32a7b3 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-r822-jq42-473c/GHSA-r822-jq42-473c.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r822-jq42-473c", + "modified": "2025-05-07T00:31:34Z", + "published": "2025-05-07T00:31:34Z", + "aliases": [ + "CVE-2025-0855" + ], + "details": "The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.8.0 via deserialization of untrusted input in the 'import_header' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0855" + }, + { + "type": "WEB", + "url": "https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/changelog" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5dfc2249-3761-49c6-966e-73c33be74c0e?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-06T23:15:50Z" + } +} \ No newline at end of file