From 1948a3bcf871bbb45f89a0ab6660d819bc020c45 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 23 Apr 2025 09:35:14 +0000 Subject: [PATCH] Publish Advisories GHSA-5937-p7hv-j7mh GHSA-7pw4-r444-g49g GHSA-8w8c-p944-gqjj GHSA-w4q5-363g-q68q --- .../GHSA-5937-p7hv-j7mh.json | 36 +++++++++++ .../GHSA-7pw4-r444-g49g.json | 52 ++++++++++++++++ .../GHSA-8w8c-p944-gqjj.json | 36 +++++++++++ .../GHSA-w4q5-363g-q68q.json | 60 +++++++++++++++++++ 4 files changed, 184 insertions(+) create mode 100644 advisories/unreviewed/2025/04/GHSA-5937-p7hv-j7mh/GHSA-5937-p7hv-j7mh.json create mode 100644 advisories/unreviewed/2025/04/GHSA-7pw4-r444-g49g/GHSA-7pw4-r444-g49g.json create mode 100644 advisories/unreviewed/2025/04/GHSA-8w8c-p944-gqjj/GHSA-8w8c-p944-gqjj.json create mode 100644 advisories/unreviewed/2025/04/GHSA-w4q5-363g-q68q/GHSA-w4q5-363g-q68q.json diff --git a/advisories/unreviewed/2025/04/GHSA-5937-p7hv-j7mh/GHSA-5937-p7hv-j7mh.json b/advisories/unreviewed/2025/04/GHSA-5937-p7hv-j7mh/GHSA-5937-p7hv-j7mh.json new file mode 100644 index 00000000000..ce49ee3132f --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-5937-p7hv-j7mh/GHSA-5937-p7hv-j7mh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5937-p7hv-j7mh", + "modified": "2025-04-23T09:33:32Z", + "published": "2025-04-23T09:33:32Z", + "aliases": [ + "CVE-2025-2595" + ], + "details": "An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2595" + }, + { + "type": "WEB", + "url": "https://certvde.com/en/advisories/VDE-2025-027" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-425" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-23T08:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-7pw4-r444-g49g/GHSA-7pw4-r444-g49g.json b/advisories/unreviewed/2025/04/GHSA-7pw4-r444-g49g/GHSA-7pw4-r444-g49g.json new file mode 100644 index 00000000000..1204082c102 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-7pw4-r444-g49g/GHSA-7pw4-r444-g49g.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7pw4-r444-g49g", + "modified": "2025-04-23T09:33:32Z", + "published": "2025-04-23T09:33:32Z", + "aliases": [ + "CVE-2025-3529" + ], + "details": "The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'file_url' parameter. This makes it possible for unauthenticated attackers to view potentially sensitive information and download a digital product without paying for it.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3529" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/includes/wpsc-shortcodes-related.php#L92" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3275373" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/#developers" + }, + { + "type": "WEB", + "url": "https://www.tipsandtricks-hq.com/ecommerce/wp-simple-cart-sell-digital-downloads-2468" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8fecc015-518f-4aab-a17e-17cf4b8cf123?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-201" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-23T08:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-8w8c-p944-gqjj/GHSA-8w8c-p944-gqjj.json b/advisories/unreviewed/2025/04/GHSA-8w8c-p944-gqjj/GHSA-8w8c-p944-gqjj.json new file mode 100644 index 00000000000..cb0cfad436b --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-8w8c-p944-gqjj/GHSA-8w8c-p944-gqjj.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8w8c-p944-gqjj", + "modified": "2025-04-23T09:33:32Z", + "published": "2025-04-23T09:33:32Z", + "aliases": [ + "CVE-2025-0618" + ], + "details": "A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamper protection event to the HX service to trigger an exception. This exception will prevent any further tamper protection events from being processed, even after a reboot of HX.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0618" + }, + { + "type": "WEB", + "url": "https://thrive.trellix.com/s/article/000014456" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-23T07:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-w4q5-363g-q68q/GHSA-w4q5-363g-q68q.json b/advisories/unreviewed/2025/04/GHSA-w4q5-363g-q68q/GHSA-w4q5-363g-q68q.json new file mode 100644 index 00000000000..61f1d9e0834 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-w4q5-363g-q68q/GHSA-w4q5-363g-q68q.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w4q5-363g-q68q", + "modified": "2025-04-23T09:33:32Z", + "published": "2025-04-23T09:33:32Z", + "aliases": [ + "CVE-2025-3530" + ], + "details": "The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.1.2. This is due to a logic flaw involving the inconsistent use of parameters during the cart addition process. The plugin uses the parameter 'product_tmp_two' for computing a security hash against price tampering while using 'wspsc_product' to display the product, allowing an unauthenticated attacker to substitute details from a cheaper product and bypass payment for a more expensive item.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3530" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L156" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L165" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L171" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L261" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3275373" + }, + { + "type": "WEB", + "url": "https://www.tipsandtricks-hq.com/wordpress-simple-paypal-shopping-cart-plugin-768" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a3910b-adc4-4633-a6a1-32ba50894be4?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-472" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-23T08:15:14Z" + } +} \ No newline at end of file