diff --git a/advisories/unreviewed/2025/01/GHSA-37v4-cwgp-x353/GHSA-37v4-cwgp-x353.json b/advisories/unreviewed/2025/01/GHSA-37v4-cwgp-x353/GHSA-37v4-cwgp-x353.json new file mode 100644 index 00000000000..2fc365e5b03 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-37v4-cwgp-x353/GHSA-37v4-cwgp-x353.json @@ -0,0 +1,34 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-37v4-cwgp-x353", + "modified": "2025-01-28T06:30:40Z", + "published": "2025-01-28T06:30:40Z", + "aliases": [ + "CVE-2025-23084" + ], + "details": "A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.\n\nOn Windows, a path that does not start with the file separator is treated as relative to the current directory. \n\nThis vulnerability affects Windows users of `path.join` API.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23084" + }, + { + "type": "WEB", + "url": "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-28T05:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-3h5v-53qj-h7p2/GHSA-3h5v-53qj-h7p2.json b/advisories/unreviewed/2025/01/GHSA-3h5v-53qj-h7p2/GHSA-3h5v-53qj-h7p2.json new file mode 100644 index 00000000000..7e82f3654a6 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-3h5v-53qj-h7p2/GHSA-3h5v-53qj-h7p2.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3h5v-53qj-h7p2", + "modified": "2025-01-28T06:30:40Z", + "published": "2025-01-28T06:30:40Z", + "aliases": [ + "CVE-2025-24810" + ], + "details": "Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege and accessing the settings screen.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24810" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/jp/JVN88046370" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/simple-image-sizes/#developers" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-28T05:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-6q6g-q64w-cwfh/GHSA-6q6g-q64w-cwfh.json b/advisories/unreviewed/2025/01/GHSA-6q6g-q64w-cwfh/GHSA-6q6g-q64w-cwfh.json new file mode 100644 index 00000000000..b3940fcad4c --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-6q6g-q64w-cwfh/GHSA-6q6g-q64w-cwfh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6q6g-q64w-cwfh", + "modified": "2025-01-28T06:30:40Z", + "published": "2025-01-28T06:30:40Z", + "aliases": [ + "CVE-2024-0149" + ], + "details": "NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker unauthorized access to files. A successful exploit of this vulnerability might lead to limited information disclosure.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0149" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5614" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-28T04:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-98qx-rgjq-qp7m/GHSA-98qx-rgjq-qp7m.json b/advisories/unreviewed/2025/01/GHSA-98qx-rgjq-qp7m/GHSA-98qx-rgjq-qp7m.json new file mode 100644 index 00000000000..7892a89eae1 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-98qx-rgjq-qp7m/GHSA-98qx-rgjq-qp7m.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-98qx-rgjq-qp7m", + "modified": "2025-01-28T06:30:40Z", + "published": "2025-01-28T06:30:40Z", + "aliases": [ + "CVE-2024-12807" + ], + "details": "The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12807" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/fcce0839-bb1d-4aa3-b236-ff5f5e9b6120" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-28T06:15:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-c2w4-vhh6-4fxw/GHSA-c2w4-vhh6-4fxw.json b/advisories/unreviewed/2025/01/GHSA-c2w4-vhh6-4fxw/GHSA-c2w4-vhh6-4fxw.json new file mode 100644 index 00000000000..41f86a7fcd4 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-c2w4-vhh6-4fxw/GHSA-c2w4-vhh6-4fxw.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c2w4-vhh6-4fxw", + "modified": "2025-01-28T06:30:40Z", + "published": "2025-01-28T06:30:40Z", + "aliases": [ + "CVE-2024-0140" + ], + "details": "NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0140" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5597" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-28T04:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-cxh2-wj62-mcxh/GHSA-cxh2-wj62-mcxh.json b/advisories/unreviewed/2025/01/GHSA-cxh2-wj62-mcxh/GHSA-cxh2-wj62-mcxh.json new file mode 100644 index 00000000000..aa9ce766647 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-cxh2-wj62-mcxh/GHSA-cxh2-wj62-mcxh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cxh2-wj62-mcxh", + "modified": "2025-01-28T06:30:40Z", + "published": "2025-01-28T06:30:40Z", + "aliases": [ + "CVE-2024-0146" + ], + "details": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause memory corruption. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, or data tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0146" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5614" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-120" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-28T04:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-fq3f-gw4f-4697/GHSA-fq3f-gw4f-4697.json b/advisories/unreviewed/2025/01/GHSA-fq3f-gw4f-4697/GHSA-fq3f-gw4f-4697.json new file mode 100644 index 00000000000..563232c33bb --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-fq3f-gw4f-4697/GHSA-fq3f-gw4f-4697.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fq3f-gw4f-4697", + "modified": "2025-01-28T06:30:40Z", + "published": "2025-01-28T06:30:40Z", + "aliases": [ + "CVE-2024-53881" + ], + "details": "NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm on the host, which may lead to denial of service.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53881" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5614" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-459" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-28T04:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-j2g5-7jvx-6r3g/GHSA-j2g5-7jvx-6r3g.json b/advisories/unreviewed/2025/01/GHSA-j2g5-7jvx-6r3g/GHSA-j2g5-7jvx-6r3g.json new file mode 100644 index 00000000000..bf0fd932ccd --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-j2g5-7jvx-6r3g/GHSA-j2g5-7jvx-6r3g.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j2g5-7jvx-6r3g", + "modified": "2025-01-28T06:30:40Z", + "published": "2025-01-28T06:30:40Z", + "aliases": [ + "CVE-2024-0147" + ], + "details": "NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been freed can lead to denial of service or data tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0147" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5614" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-28T04:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-j688-f63h-5495/GHSA-j688-f63h-5495.json b/advisories/unreviewed/2025/01/GHSA-j688-f63h-5495/GHSA-j688-f63h-5495.json new file mode 100644 index 00000000000..07d3b2f52af --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-j688-f63h-5495/GHSA-j688-f63h-5495.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j688-f63h-5495", + "modified": "2025-01-28T06:30:40Z", + "published": "2025-01-28T06:30:40Z", + "aliases": [ + "CVE-2024-53869" + ], + "details": "NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A successful exploit of this vulnerability might lead to information disclosure.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53869" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5614" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-459" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-28T04:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-mcv5-jrjw-4vgm/GHSA-mcv5-jrjw-4vgm.json b/advisories/unreviewed/2025/01/GHSA-mcv5-jrjw-4vgm/GHSA-mcv5-jrjw-4vgm.json new file mode 100644 index 00000000000..46c1d14862d --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-mcv5-jrjw-4vgm/GHSA-mcv5-jrjw-4vgm.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mcv5-jrjw-4vgm", + "modified": "2025-01-28T06:30:40Z", + "published": "2025-01-28T06:30:40Z", + "aliases": [ + "CVE-2024-12723" + ], + "details": "The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12723" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/d9053b8b-c05c-42fd-913e-f85c799df807" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-28T06:15:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-qw3g-f6r4-547w/GHSA-qw3g-f6r4-547w.json b/advisories/unreviewed/2025/01/GHSA-qw3g-f6r4-547w/GHSA-qw3g-f6r4-547w.json new file mode 100644 index 00000000000..506d127faff --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-qw3g-f6r4-547w/GHSA-qw3g-f6r4-547w.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qw3g-f6r4-547w", + "modified": "2025-01-28T06:30:40Z", + "published": "2025-01-28T06:30:40Z", + "aliases": [ + "CVE-2024-11135" + ], + "details": "The Eventer plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'eventer_get_attendees' function in all versions up to, and including, 3.9.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11135" + }, + { + "type": "WEB", + "url": "https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8dc0712-f78e-46c5-a0d1-2db752498d54?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-28T05:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-w57r-3px7-jqgg/GHSA-w57r-3px7-jqgg.json b/advisories/unreviewed/2025/01/GHSA-w57r-3px7-jqgg/GHSA-w57r-3px7-jqgg.json new file mode 100644 index 00000000000..61a6443849f --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-w57r-3px7-jqgg/GHSA-w57r-3px7-jqgg.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w57r-3px7-jqgg", + "modified": "2025-01-28T06:30:40Z", + "published": "2025-01-28T06:30:40Z", + "aliases": [ + "CVE-2024-0150" + ], + "details": "NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before the beginning of a buffer. A successful exploit of this vulnerability might lead to information disclosure, denial of service, or data tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0150" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5614" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-28T04:15:09Z" + } +} \ No newline at end of file