Publish Advisories

GHSA-3wjq-jhph-jc7q GHSA-cmmx-wwp2-x696 GHSA-x45x-pqwc-c7f3
2026-05-22 18:04:22 -07:00 · 2025-01-05 15:31:57 +00:00
parent cc688888f0
commit 1ebf369606
3 changed files with 156 additions and 0 deletions
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3wjq-jhph-jc7q",
+  "modified": "2025-01-05T15:30:30Z",
+  "published": "2025-01-05T15:30:30Z",
+  "aliases": [
+    "CVE-2025-0220"
+  ],
+  "details": "A vulnerability, which was classified as problematic, was found in Trimble SPS851 488.01. This affects an unknown part of the component Ethernet Configuration Menu. The manipulation of the argument Hostname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0220"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/renanmalafatti/CVE/blob/main/CVE-2025-0220.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.290199"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.290199"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.464943"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-05T13:15:05Z"
+  }
+}
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cmmx-wwp2-x696",
+  "modified": "2025-01-05T15:30:30Z",
+  "published": "2025-01-05T15:30:30Z",
+  "aliases": [
+    "CVE-2024-13141"
+  ],
+  "details": "A vulnerability classified as problematic was found in osuuu LightPicture up to 1.2.2. This vulnerability affects unknown code of the file /api/upload of the component SVG File Upload Handler. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13141"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Hebing123/cve/issues/83"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.290224"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.290224"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.468645"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-05T15:15:17Z"
+  }
+}
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x45x-pqwc-c7f3",
+  "modified": "2025-01-05T15:30:30Z",
+  "published": "2025-01-05T15:30:30Z",
+  "aliases": [
+    "CVE-2025-0221"
+  ],
+  "details": "A vulnerability has been found in IOBit Protected Folder up to 1.3.0 and classified as problematic. This vulnerability affects the function 0x22200c in the library pffilter.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0221"
+    },
+    {
+      "type": "WEB",
+      "url": "https://shareforall.notion.site/IOBit-Protected-Folder-pffilter-0x22200C-NPD-DOS-15260437bb1e80b2a477d42396d5d06c"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.290200"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.290200"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.466955"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-404"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-05T15:15:17Z"
+  }
+}