netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-242m-6h72-7hgp
GHSA-5hrq-c7h5-rwmw
GHSA-6w4r-jf22-qmrj
GHSA-7q6m-9v39-q68q
GHSA-823x-fv5p-h7hw
GHSA-98xh-6hr4-2qwh
GHSA-9v3j-xfw8-fgh8
GHSA-fgpq-r4xv-rw5g
GHSA-fwwp-xcxw-39vq
GHSA-mgvx-rpfc-9mpv
GHSA-pc7g-pr5v-48jw
GHSA-qjhv-xmmx-gvgp
GHSA-vg63-w3p9-jc9m
GHSA-w27p-m7fr-3hpc
GHSA-w638-4h8h-246j
This commit is contained in:
advisory-database[bot]
2025-03-25 00:31:55 +00:00
parent 8783e76099
commit 1675ec5ffd
15 changed files with 598 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-242m-6h72-7hgp",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-24513"
],
"details": "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24513"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/131005"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-25T00:15:14Z"
}
}
advisories/unreviewed/2025/03/GHSA-5hrq-c7h5-rwmw/GHSA-5hrq-c7h5-rwmw.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5hrq-c7h5-rwmw",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-2716"
],
"details": "A vulnerability classified as problematic was found in China Mobile P22g-CIac 1.0.00.488. This vulnerability affects unknown code of the component Samba Path Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2716"
},
{
"type": "WEB",
"url": "https://github.com/rookiiiiiiie/China-Mobile-Internet-of-Things-Co.-Ltd./blob/main/Issues.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.300736"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.300736"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.519900"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-24T23:15:13Z"
}
}
advisories/unreviewed/2025/03/GHSA-6w4r-jf22-qmrj/GHSA-6w4r-jf22-qmrj.json
+48
View File
@@ -0,0 +1,48 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6w4r-jf22-qmrj",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-2714"
],
"details": "A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /extensions/realestate/index.php/agents/agent-register/addagent. The manipulation of the argument plan_id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2714"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.300734"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.300734"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.517638"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-24T22:15:14Z"
}
}
advisories/unreviewed/2025/03/GHSA-7q6m-9v39-q68q/GHSA-7q6m-9v39-q68q.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7q6m-9v39-q68q",
"modified": "2025-03-18T15:30:49Z",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-18T15:30:49Z",
"aliases": [
"CVE-2025-30111"
],
"details": "On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream. The dashcam exposes endpoints that allow unauthorized users, who gained access through other means, to list and download recorded videos, as well as access live video streams without proper authentication.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-306"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-18T15:16:02Z"
advisories/unreviewed/2025/03/GHSA-823x-fv5p-h7hw/GHSA-823x-fv5p-h7hw.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-823x-fv5p-h7hw",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-1097"
],
"details": "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1097"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/131007"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-25T00:15:13Z"
}
}
advisories/unreviewed/2025/03/GHSA-98xh-6hr4-2qwh/GHSA-98xh-6hr4-2qwh.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-98xh-6hr4-2qwh",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-26512"
],
"details": "SnapCenter versions prior to \n6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an \nauthenticated SnapCenter Server user to become an admin user on a remote\n system where a SnapCenter plug-in has been installed.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26512"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/NTAP-20250324-0001"
}
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-24T22:15:13Z"
}
}
advisories/unreviewed/2025/03/GHSA-9v3j-xfw8-fgh8/GHSA-9v3j-xfw8-fgh8.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9v3j-xfw8-fgh8",
"modified": "2025-03-18T15:30:49Z",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-18T15:30:49Z",
"aliases": [
"CVE-2025-30107"
],
"details": "On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. A vulnerability in the dashcam's configuration management allows unauthorized users to modify settings, disable critical functions, and turn off battery protection, potentially causing physical damage to the vehicle.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-862"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-18T15:16:01Z"
advisories/unreviewed/2025/03/GHSA-fgpq-r4xv-rw5g/GHSA-fgpq-r4xv-rw5g.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fgpq-r4xv-rw5g",
"modified": "2025-03-25T00:30:27Z",
"published": "2025-03-25T00:30:27Z",
"aliases": [
"CVE-2025-2721"
],
"details": "A vulnerability was found in GNOME libgsf up to 1.14.53. It has been classified as critical. This affects the function gsf_base64_encode_simple. The manipulation of the argument size_t leads to heap-based buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2721"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.300741"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.300741"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.520181"
},
{
"type": "WEB",
"url": "https://www.gnome.org"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-25T00:15:15Z"
}
}
advisories/unreviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fwwp-xcxw-39vq",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-24514"
],
"details": "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24514"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/131006"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-25T00:15:15Z"
}
}
advisories/unreviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mgvx-rpfc-9mpv",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-1974"
],
"details": "A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1974"
},
{
"type": "WEB",
"url": "https://https://github.com/kubernetes/kubernetes/issues/131009"
}
],
"database_specific": {
"cwe_ids": [
"CWE-653"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-25T00:15:14Z"
}
}
advisories/unreviewed/2025/03/GHSA-pc7g-pr5v-48jw/GHSA-pc7g-pr5v-48jw.json
+48
View File
@@ -0,0 +1,48 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pc7g-pr5v-48jw",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-2712"
],
"details": "A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /help/top.jsp. The manipulation of the argument langcode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2712"
},
{
"type": "WEB",
"url": "https://github.com/Hebing123/cve/issues/86"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.300733"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.300733"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-24T22:15:14Z"
}
}
advisories/unreviewed/2025/03/GHSA-qjhv-xmmx-gvgp/GHSA-qjhv-xmmx-gvgp.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qjhv-xmmx-gvgp",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-2715"
],
"details": "A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatch_Invoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2715"
},
{
"type": "WEB",
"url": "https://github.com/janssensjelle/published-pocs/blob/main/weberp-xss-confirm-dispatch.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.300735"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.300735"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.519791"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-24T23:15:13Z"
}
}
advisories/unreviewed/2025/03/GHSA-vg63-w3p9-jc9m/GHSA-vg63-w3p9-jc9m.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vg63-w3p9-jc9m",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-1098"
],
"details": "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1098"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/131008"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-25T00:15:14Z"
}
}
advisories/unreviewed/2025/03/GHSA-w27p-m7fr-3hpc/GHSA-w27p-m7fr-3hpc.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w27p-m7fr-3hpc",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-2717"
],
"details": "A vulnerability, which was classified as critical, has been found in D-Link DIR-823X 240126/240802. This issue affects the function sub_41710C of the file /goform/diag_nslookup of the component HTTP POST Request Handler. The manipulation of the argument target_addr leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2717"
},
{
"type": "WEB",
"url": "https://github.com/mono7s/Dir-823x/blob/main/diag_nslookup/diag_nslookup.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.300737"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.300737"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.517958"
},
{
"type": "WEB",
"url": "https://www.dlink.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-25T00:15:15Z"
}
}
advisories/unreviewed/2025/03/GHSA-w638-4h8h-246j/GHSA-w638-4h8h-246j.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w638-4h8h-246j",
"modified": "2025-03-25T00:30:27Z",
"published": "2025-03-25T00:30:27Z",
"aliases": [
"CVE-2025-2720"
],
"details": "A vulnerability was found in GNOME libgsf up to 1.14.53 and classified as problematic. Affected by this issue is the function gsf_base64_encode_simple. The manipulation of the argument size leads to use of uninitialized variable. The attack needs to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2720"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.300740"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.300740"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.520180"
},
{
"type": "WEB",
"url": "https://www.gnome.org"
}
],
"database_specific": {
"cwe_ids": [
"CWE-453"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-25T00:15:15Z"
}
}