netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-jpf5-526x-c5hw
GHSA-3px7-c4j3-576r
GHSA-5pmj-5f4j-wp6g
GHSA-66jp-pv2h-9x27
GHSA-6m28-m6gv-xv6v
GHSA-6mcc-q3mg-3qg6
GHSA-955w-rv3v-9m9p
GHSA-9j65-rv5x-4vrf
GHSA-mv4p-726j-2pc3
GHSA-qqx6-6jxm-2crq
GHSA-rjm9-pqrp-74v6
GHSA-w36f-4w8p-r5j5
GHSA-whjq-92qp-qg76
GHSA-x4gv-4vpc-956p
This commit is contained in:
advisory-database[bot]
2025-06-02 12:32:40 +00:00
parent 9fe0539497
commit 1202cd2f76
14 changed files with 586 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/05/GHSA-jpf5-526x-c5hw/GHSA-jpf5-526x-c5hw.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jpf5-526x-c5hw",
"modified": "2025-05-31T03:30:33Z",
"modified": "2025-06-02T12:30:33Z",
"published": "2025-05-30T15:30:30Z",
"aliases": [
"CVE-2025-40909"
@@ -54,6 +54,10 @@
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/05/30/4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/06/02/2"
}
],
"database_specific": {
advisories/unreviewed/2025/06/GHSA-3px7-c4j3-576r/GHSA-3px7-c4j3-576r.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3px7-c4j3-576r",
"modified": "2025-06-02T12:30:33Z",
"published": "2025-06-02T12:30:33Z",
"aliases": [
"CVE-2025-3260"
],
"details": "A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1).\n\nImpact:\n\n- Viewers can view all dashboards/folders regardless of permissions\n\n- Editors can view/edit/delete all dashboards/folders regardless of permissions\n\n- Editors can create dashboards in any folder regardless of permissions\n\n- Anonymous users with viewer/editor roles are similarly affected\n\nOrganization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3260"
},
{
"type": "WEB",
"url": "https://grafana.com/security/security-advisories/CVE-2025-3260"
}
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T10:15:21Z"
}
}
advisories/unreviewed/2025/06/GHSA-5pmj-5f4j-wp6g/GHSA-5pmj-5f4j-wp6g.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5pmj-5f4j-wp6g",
"modified": "2025-06-02T12:30:34Z",
"published": "2025-06-02T12:30:34Z",
"aliases": [
"CVE-2025-46807"
],
"details": "A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh and deny legitimate users service.This issue affects sslh before 2.2.4.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46807"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46807"
},
{
"type": "WEB",
"url": "https://github.com/yrutschle/sslh/releases/tag/v2.2.4"
}
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T12:15:24Z"
}
}
advisories/unreviewed/2025/06/GHSA-66jp-pv2h-9x27/GHSA-66jp-pv2h-9x27.json
+31
View File
@@ -0,0 +1,31 @@
{
"schema_version": "1.4.0",
"id": "GHSA-66jp-pv2h-9x27",
"modified": "2025-06-02T12:30:33Z",
"published": "2025-06-02T12:30:33Z",
"aliases": [
"CVE-2025-0819"
],
"details": "Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r44p0 through r49p3, from r50p0 through r51p0; Valhall GPU Kernel Driver: from r44p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r44p0 through r49p3, from r50p0 through r54p0.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0819"
},
{
"type": "WEB",
"url": "https://developer.arm.com/documentation/110466/latest"
}
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T11:15:21Z"
}
}
advisories/unreviewed/2025/06/GHSA-6m28-m6gv-xv6v/GHSA-6m28-m6gv-xv6v.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6m28-m6gv-xv6v",
"modified": "2025-06-02T12:30:34Z",
"published": "2025-06-02T12:30:34Z",
"aliases": [
"CVE-2025-5441"
],
"details": "A vulnerability classified as critical was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function setDeviceURL of the file /goform/setDeviceURL. The manipulation of the argument DeviceURL leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5441"
},
{
"type": "WEB",
"url": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_4/4.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310780"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310780"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.584363"
},
{
"type": "WEB",
"url": "https://www.linksys.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T11:15:23Z"
}
}
advisories/unreviewed/2025/06/GHSA-6mcc-q3mg-3qg6/GHSA-6mcc-q3mg-3qg6.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6mcc-q3mg-3qg6",
"modified": "2025-06-02T12:30:33Z",
"published": "2025-06-02T12:30:33Z",
"aliases": [
"CVE-2025-1750"
],
"details": "An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1750"
},
{
"type": "WEB",
"url": "https://github.com/run-llama/llama_index/commit/369a2942df2efcf6b74461c45d20a0af1fbe4ae2"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/e1302233-9180-4269-9047-1526247d2cd8"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T10:15:20Z"
}
}
advisories/unreviewed/2025/06/GHSA-955w-rv3v-9m9p/GHSA-955w-rv3v-9m9p.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-955w-rv3v-9m9p",
"modified": "2025-06-02T12:30:34Z",
"published": "2025-06-02T12:30:34Z",
"aliases": [
"CVE-2025-5444"
],
"details": "A vulnerability has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classified as critical. Affected by this vulnerability is the function RP_UpgradeFWByBBS of the file /goform/RP_UpgradeFWByBBS. The manipulation of the argument type/ch/ssidhex/security/extch/pwd/mode/ip/nm/gw leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5444"
},
{
"type": "WEB",
"url": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_7/7.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310783"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310783"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.584366"
},
{
"type": "WEB",
"url": "https://www.linksys.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T12:15:26Z"
}
}
advisories/unreviewed/2025/06/GHSA-9j65-rv5x-4vrf/GHSA-9j65-rv5x-4vrf.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9j65-rv5x-4vrf",
"modified": "2025-06-02T12:30:33Z",
"published": "2025-06-02T12:30:33Z",
"aliases": [
"CVE-2025-3454"
],
"details": "This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path.\n\nUsers with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources.\n\nThe issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3454"
},
{
"type": "WEB",
"url": "https://grafana.com/security/security-advisories/cve-2025-3454"
}
],
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T11:15:22Z"
}
}
advisories/unreviewed/2025/06/GHSA-mv4p-726j-2pc3/GHSA-mv4p-726j-2pc3.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mv4p-726j-2pc3",
"modified": "2025-06-02T12:30:33Z",
"published": "2025-06-02T12:30:33Z",
"aliases": [
"CVE-2025-5440"
],
"details": "A vulnerability classified as critical has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function NTP of the file /goform/NTP. The manipulation of the argument manual_year_select/manual_month_select/manual_day_select/manual_hour_select/manual_min_select/manual_sec_select leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5440"
},
{
"type": "WEB",
"url": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_3/3.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310779"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310779"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.584362"
},
{
"type": "WEB",
"url": "https://www.linksys.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T10:15:22Z"
}
}
advisories/unreviewed/2025/06/GHSA-qqx6-6jxm-2crq/GHSA-qqx6-6jxm-2crq.json
+31
View File
@@ -0,0 +1,31 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qqx6-6jxm-2crq",
"modified": "2025-06-02T12:30:33Z",
"published": "2025-06-02T12:30:33Z",
"aliases": [
"CVE-2025-1246"
],
"details": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access outside of buffer bounds.This issue affects Bifrost GPU Userspace Driver: from r18p0 through r49p3, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r28p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r49p3, from r50p0 through r54p0.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1246"
},
{
"type": "WEB",
"url": "https://developer.arm.com/documentation/110466/latest"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T11:15:21Z"
}
}
advisories/unreviewed/2025/06/GHSA-rjm9-pqrp-74v6/GHSA-rjm9-pqrp-74v6.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rjm9-pqrp-74v6",
"modified": "2025-06-02T12:30:34Z",
"published": "2025-06-02T12:30:34Z",
"aliases": [
"CVE-2025-5442"
],
"details": "A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function RP_pingGatewayByBBS of the file /goform/RP_pingGatewayByBBS. The manipulation of the argument ip/nm/gw leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5442"
},
{
"type": "WEB",
"url": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_5/5.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310781"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310781"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.584364"
},
{
"type": "WEB",
"url": "https://www.linksys.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T11:15:23Z"
}
}
advisories/unreviewed/2025/06/GHSA-w36f-4w8p-r5j5/GHSA-w36f-4w8p-r5j5.json
+31
View File
@@ -0,0 +1,31 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w36f-4w8p-r5j5",
"modified": "2025-06-02T12:30:33Z",
"published": "2025-06-02T12:30:33Z",
"aliases": [
"CVE-2025-0073"
],
"details": "Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 before r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 before r54p0.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0073"
},
{
"type": "WEB",
"url": "https://developer.arm.com/documentation/110466/latest"
}
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T11:15:21Z"
}
}
advisories/unreviewed/2025/06/GHSA-whjq-92qp-qg76/GHSA-whjq-92qp-qg76.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-whjq-92qp-qg76",
"modified": "2025-06-02T12:30:33Z",
"published": "2025-06-02T12:30:33Z",
"aliases": [
"CVE-2025-5439"
],
"details": "A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been rated as critical. Affected by this issue is the function verifyFacebookLike of the file /goform/verifyFacebookLike. The manipulation of the argument uid/accessToken leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5439"
},
{
"type": "WEB",
"url": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_2/2.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310778"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310778"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.584361"
},
{
"type": "WEB",
"url": "https://www.linksys.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T10:15:21Z"
}
}
advisories/unreviewed/2025/06/GHSA-x4gv-4vpc-956p/GHSA-x4gv-4vpc-956p.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x4gv-4vpc-956p",
"modified": "2025-06-02T12:30:34Z",
"published": "2025-06-02T12:30:34Z",
"aliases": [
"CVE-2025-5443"
],
"details": "A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the function wirelessAdvancedHidden of the file /goform/wirelessAdvancedHidden. The manipulation of the argument ExtChSelector/24GSelector/5GSelector leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5443"
},
{
"type": "WEB",
"url": "https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_6/6.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310782"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310782"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.584365"
},
{
"type": "WEB",
"url": "https://www.linksys.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T12:15:26Z"
}
}