netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2025-05-02 15:32:55 +00:00
parent 10ca5ee9d4
commit 19a021a9cd
73 changed files with 2145 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/12/GHSA-8wrq-79wc-jr56/GHSA-8wrq-79wc-jr56.json
+2 -1
View File
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
"CWE-77",
"CWE-78"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2022/12/GHSA-xrxj-jg56-83p4/GHSA-xrxj-jg56-83p4.json
+2 -1
View File
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
"CWE-77",
"CWE-78"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/06/GHSA-45xf-mpvq-5ggq/GHSA-45xf-mpvq-5ggq.json
+1
View File
@@ -26,6 +26,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-129",
"CWE-400"
],
"severity": "HIGH",
advisories/unreviewed/2024/07/GHSA-g345-r3xq-7xxq/GHSA-g345-r3xq-7xxq.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2024/07/GHSA-w4hr-5x27-752x/GHSA-w4hr-5x27-752x.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2024/07/GHSA-wh4c-fpvw-r5xc/GHSA-wh4c-fpvw-r5xc.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2025/04/GHSA-7w9p-pr7x-mjw2/GHSA-7w9p-pr7x-mjw2.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7w9p-pr7x-mjw2",
"modified": "2025-04-26T03:30:32Z",
"modified": "2025-05-02T15:31:16Z",
"published": "2025-04-24T18:31:08Z",
"aliases": [
"CVE-2025-31324"
@@ -23,6 +23,10 @@
"type": "WEB",
"url": "https://me.sap.com/notes/3594142"
},
{
"type": "WEB",
"url": "https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
advisories/unreviewed/2025/04/GHSA-fv83-m6v9-qw8v/GHSA-fv83-m6v9-qw8v.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fv83-m6v9-qw8v",
"modified": "2025-04-30T18:31:56Z",
"modified": "2025-05-02T15:31:24Z",
"published": "2025-04-30T18:31:56Z",
"aliases": [
"CVE-2025-46619"
],
"details": "A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensitive files. Depending on the level of privileges, this vulnerability may grant access to files such as /etc/passwd or /etc/shadow.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
}
],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-284"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-30T18:15:48Z"
advisories/unreviewed/2025/04/GHSA-hf49-wfhj-98g5/GHSA-hf49-wfhj-98g5.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hf49-wfhj-98g5",
"modified": "2025-04-30T18:31:56Z",
"modified": "2025-05-02T15:31:24Z",
"published": "2025-04-30T18:31:55Z",
"aliases": [
"CVE-2025-44194"
],
"details": "SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_household.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-30T18:15:47Z"
advisories/unreviewed/2025/04/GHSA-px62-fqwr-9g32/GHSA-px62-fqwr-9g32.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-px62-fqwr-9g32",
"modified": "2025-04-30T18:31:55Z",
"modified": "2025-05-02T15:31:23Z",
"published": "2025-04-30T18:31:55Z",
"aliases": [
"CVE-2025-44193"
],
"details": "SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_complaint.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-30T18:15:47Z"
advisories/unreviewed/2025/05/GHSA-235m-7f4x-p4m8/GHSA-235m-7f4x-p4m8.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-235m-7f4x-p4m8",
"modified": "2025-05-02T15:31:45Z",
"published": "2025-05-02T15:31:45Z",
"aliases": [
"CVE-2025-44866"
],
"details": "Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-44866"
},
{
"type": "WEB",
"url": "https://github.com/Summermu/VulnForIoT/tree/main/Tenda_W20E/formSetDebugCfg_level/readme.md"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T18:15:57Z"
}
}
advisories/unreviewed/2025/05/GHSA-2954-4rrv-2pfp/GHSA-2954-4rrv-2pfp.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2954-4rrv-2pfp",
"modified": "2025-05-02T06:31:25Z",
"modified": "2025-05-02T15:31:47Z",
"published": "2025-05-02T06:31:25Z",
"aliases": [
"CVE-2025-3514"
],
"details": "The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-02T06:15:48Z"
advisories/unreviewed/2025/05/GHSA-2f49-8wxx-67mg/GHSA-2f49-8wxx-67mg.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2f49-8wxx-67mg",
"modified": "2025-05-02T15:31:48Z",
"published": "2025-05-02T15:31:48Z",
"aliases": [
"CVE-2025-4204"
],
"details": "The Ultimate Auction Pro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4204"
},
{
"type": "WEB",
"url": "https://auctionplugin.net/changelog/ultimate-woo-auction-pro"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e492029d-6613-4881-b986-9fe14cb2cf74?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-02T13:15:47Z"
}
}
advisories/unreviewed/2025/05/GHSA-2f6c-h568-c2f2/GHSA-2f6c-h568-c2f2.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2f6c-h568-c2f2",
"modified": "2025-05-02T15:31:45Z",
"published": "2025-05-02T15:31:45Z",
"aliases": [
"CVE-2025-35975"
],
"details": "MicroDicom DICOM Viewer is vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code. The user must open a malicious DCM file for exploitation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35975"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-121-01"
}
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T19:15:57Z"
}
}
advisories/unreviewed/2025/05/GHSA-2px4-35vj-j3x5/GHSA-2px4-35vj-j3x5.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2px4-35vj-j3x5",
"modified": "2025-05-02T15:31:44Z",
"published": "2025-05-02T15:31:44Z",
"aliases": [
"CVE-2025-44861"
],
"details": "TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-44861"
},
{
"type": "WEB",
"url": "https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA300-POE/CloudSrvUserdataVersionCheck/readme.md"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T18:15:56Z"
}
}
advisories/unreviewed/2025/05/GHSA-38h7-w62h-qf32/GHSA-38h7-w62h-qf32.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-38h7-w62h-qf32",
"modified": "2025-05-02T15:31:49Z",
"published": "2025-05-02T15:31:49Z",
"aliases": [
"CVE-2025-44868"
],
"details": "Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-44868"
},
{
"type": "WEB",
"url": "https://github.com/Summermu/VulnForIoT/tree/main/Wavlink_WL-WN530H4/ping_test/readme.md"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-02T15:15:49Z"
}
}
advisories/unreviewed/2025/05/GHSA-47r6-rvxr-w4cc/GHSA-47r6-rvxr-w4cc.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-47r6-rvxr-w4cc",
"modified": "2025-05-02T15:31:45Z",
"published": "2025-05-02T15:31:45Z",
"aliases": [
"CVE-2025-44867"
],
"details": "Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-44867"
},
{
"type": "WEB",
"url": "https://github.com/Summermu/VulnForIoT/tree/main/Tenda_W20E/formSetNetCheckTools/readme.md"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T18:15:57Z"
}
}
advisories/unreviewed/2025/05/GHSA-4p7f-6rw5-m5v7/GHSA-4p7f-6rw5-m5v7.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4p7f-6rw5-m5v7",
"modified": "2025-05-02T15:31:48Z",
"published": "2025-05-02T15:31:47Z",
"aliases": [
"CVE-2025-2605"
],
"details": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most recent version of this product.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2605"
},
{
"type": "WEB",
"url": "https://www.honeywell.com/us/en/product-security#security-notices"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-02T13:15:46Z"
}
}
advisories/unreviewed/2025/05/GHSA-54g8-pj2j-rgc7/GHSA-54g8-pj2j-rgc7.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-54g8-pj2j-rgc7",
"modified": "2025-05-02T15:31:44Z",
"published": "2025-05-02T15:31:44Z",
"aliases": [
"CVE-2025-44860"
],
"details": "TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-44860"
},
{
"type": "WEB",
"url": "https://github.com/Summermu/VulnForIoT/tree/main/Totolink_CA300-POE/msg_process_Port/readme.md"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T18:15:56Z"
}
}
advisories/unreviewed/2025/05/GHSA-5gp3-3rvx-qhx2/GHSA-5gp3-3rvx-qhx2.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5gp3-3rvx-qhx2",
"modified": "2025-05-01T06:30:28Z",
"modified": "2025-05-02T15:31:26Z",
"published": "2025-05-01T06:30:28Z",
"aliases": [
"CVE-2024-13381"
],
"details": "The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-01T06:15:33Z"

Some files were not shown because too many files have changed in this diff Show More