Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-03-24 21:31:56 +00:00
parent 1246eb5362
commit 2525c8aeeb
66 changed files with 938 additions and 74 deletions
@@ -1,11 +1,12 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-88m2-j94x-v4fx",
-  "modified": "2025-03-24T09:34:03Z",
+  "modified": "2025-03-24T21:31:19Z",
  "published": "2025-03-24T09:34:03Z",
  "aliases": [
    "CVE-2025-2689"
  ],
+  "summary": "yiisoft Yii2 Deserialization of Untrusted Data",
  "details": "A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\\finder\\Iterator\\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
  "severity": [
    {
@@ -14,10 +15,30 @@
    },
    {
      "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "yiisoft/yii2-dev"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "2.0.45"
+            }
+          ]
+        }
+      ]
    }
  ],
-  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -27,6 +48,10 @@
      "type": "WEB",
      "url": "https://github.com/gaorenyusi/gaorenyusi/blob/main/Yii2.md"
    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/yiisoft/yii2"
+    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.300710"
@@ -46,8 +71,8 @@
      "CWE-502"
    ],
    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-24T21:31:19Z",
    "nvd_published_at": "2025-03-24T07:15:14Z"
  }
 }
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3jrv-f6qj-v68p",
-  "modified": "2025-03-18T21:31:41Z",
+  "modified": "2025-03-24T21:30:25Z",
  "published": "2022-05-24T17:25:33Z",
  "aliases": [
    "CVE-2020-16296"
@@ -23,6 +23,10 @@
      "type": "WEB",
      "url": "https://bugs.ghostscript.com/show_bug.cgi?id=701792"
    },
+    {
+      "type": "WEB",
+      "url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/tree/contrib/lips4/gdevlips.c?h=ghostscript-9.18#n163"
+    },
    {
      "type": "WEB",
      "url": "https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=9f39ed4a92578a020ae10459643e1fe72573d134"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-jxfm-c4r3-w3f8",
-  "modified": "2025-03-18T21:31:41Z",
+  "modified": "2025-03-24T21:30:25Z",
  "published": "2022-05-24T17:25:35Z",
  "aliases": [
    "CVE-2020-17538"
@@ -23,6 +23,10 @@
      "type": "WEB",
      "url": "https://bugs.ghostscript.com/show_bug.cgi?id=701792"
    },
+    {
+      "type": "WEB",
+      "url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/tree/contrib/lips4/gdevlips.c?h=ghostscript-9.18#n148"
+    },
    {
      "type": "WEB",
      "url": "https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=9f39ed4a92578a020ae10459643e1fe72573d134"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-32cm-387p-hxf5",
-  "modified": "2023-02-16T21:30:28Z",
+  "modified": "2025-03-24T21:30:27Z",
  "published": "2023-02-10T00:30:19Z",
  "aliases": [
    "CVE-2023-24686"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5fmp-xvxf-rqw7",
-  "modified": "2023-02-16T21:30:28Z",
+  "modified": "2025-03-24T21:30:27Z",
  "published": "2023-02-09T21:30:28Z",
  "aliases": [
    "CVE-2023-24322"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5rg3-6jx4-c2qf",
-  "modified": "2023-02-16T15:30:29Z",
+  "modified": "2025-03-24T21:30:26Z",
  "published": "2023-02-09T18:30:27Z",
  "aliases": [
    "CVE-2022-48289"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-6f2j-w8wg-p875",
-  "modified": "2023-02-16T21:30:28Z",
+  "modified": "2025-03-24T21:30:26Z",
  "published": "2023-02-09T18:30:27Z",
  "aliases": [
    "CVE-2022-48290"
@@ -29,7 +29,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-693"
+    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-6g22-jcp8-98gm",
-  "modified": "2023-02-17T00:30:29Z",
+  "modified": "2025-03-24T21:30:27Z",
  "published": "2023-02-10T15:30:28Z",
  "aliases": [
    "CVE-2023-24347"
@@ -30,6 +30,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-121",
      "CWE-787"
    ],
    "severity": "HIGH",
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9qfw-q6c7-9cmx",
-  "modified": "2023-02-17T00:30:29Z",
+  "modified": "2025-03-24T21:30:27Z",
  "published": "2023-02-10T15:30:28Z",
  "aliases": [
    "CVE-2023-24346"
@@ -30,6 +30,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-121",
      "CWE-787"
    ],
    "severity": "HIGH",
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9x9w-38h4-6344",
-  "modified": "2023-02-16T21:30:28Z",
+  "modified": "2025-03-24T21:30:27Z",
  "published": "2023-02-09T21:30:27Z",
  "aliases": [
    "CVE-2023-24688"
@@ -29,7 +29,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-284"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c3qc-xqj2-mqfj",
-  "modified": "2023-02-16T21:30:28Z",
+  "modified": "2025-03-24T21:30:27Z",
  "published": "2023-02-09T21:30:27Z",
  "aliases": [
    "CVE-2023-24689"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-cxm9-p3px-pf2v",
-  "modified": "2023-02-16T21:30:28Z",
+  "modified": "2025-03-24T21:30:27Z",
  "published": "2023-02-10T00:30:19Z",
  "aliases": [
    "CVE-2023-24690"
@@ -26,6 +26,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-75",
      "CWE-94"
    ],
    "severity": "HIGH",
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fcgr-87fq-q88m",
-  "modified": "2023-02-16T21:30:28Z",
+  "modified": "2025-03-24T21:30:27Z",
  "published": "2023-02-10T00:30:20Z",
  "aliases": [
    "CVE-2023-24684"
@@ -19,6 +19,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24684"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ChurchCRM/CRM/issues/6440"
+    },
    {
      "type": "WEB",
      "url": "https://github.com/ChurchCRM/CRM"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-g4r8-m469-x6vf",
-  "modified": "2023-02-16T15:30:30Z",
+  "modified": "2025-03-24T21:30:26Z",
  "published": "2023-02-09T18:30:27Z",
  "aliases": [
    "CVE-2022-48288"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-h27p-fqrc-98gx",
-  "modified": "2023-02-16T21:30:28Z",
+  "modified": "2025-03-24T21:30:27Z",
  "published": "2023-02-09T21:30:27Z",
  "aliases": [
    "CVE-2023-24687"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hfmc-qg6v-fwjv",
-  "modified": "2023-02-17T18:30:24Z",
+  "modified": "2025-03-24T21:30:27Z",
  "published": "2023-02-10T00:30:20Z",
  "aliases": [
    "CVE-2023-23592"
@@ -29,7 +29,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-200"
+    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-jh27-8mvh-57qm",
-  "modified": "2023-02-16T15:30:29Z",
+  "modified": "2025-03-24T21:30:25Z",
  "published": "2023-02-09T18:30:28Z",
  "aliases": [
    "CVE-2023-0624"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-m48w-94wx-3fq6",
-  "modified": "2023-02-16T21:30:28Z",
+  "modified": "2025-03-24T21:30:27Z",
  "published": "2023-02-09T18:30:27Z",
  "aliases": [
    "CVE-2022-48293"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-m5cj-m2cq-qv2p",
-  "modified": "2023-02-17T15:30:26Z",
+  "modified": "2025-03-24T21:30:27Z",
  "published": "2023-02-09T18:30:27Z",
  "aliases": [
    "CVE-2022-48301"
--- a/Show More
+++ b/Show More