Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-05-09 18:32:09 +00:00
parent a6a300c7b7
commit 294a71ccf6
39 changed files with 1113 additions and 11 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-73xq-c68f-h599",
-  "modified": "2022-10-28T12:00:34Z",
+  "modified": "2025-05-09T18:30:35Z",
  "published": "2022-10-26T12:00:30Z",
  "aliases": [
    "CVE-2022-28170"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c4gp-696g-43xv",
-  "modified": "2022-10-28T19:00:42Z",
+  "modified": "2025-05-09T18:30:35Z",
  "published": "2022-10-26T12:00:30Z",
  "aliases": [
    "CVE-2022-28169"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8mgx-wgjw-q32g",
-  "modified": "2024-01-23T18:31:11Z",
+  "modified": "2025-05-09T18:30:35Z",
  "published": "2024-01-16T18:31:10Z",
  "aliases": [
    "CVE-2024-0239"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-h9pp-v4f3-fp7x",
-  "modified": "2024-01-23T21:30:20Z",
+  "modified": "2025-05-09T18:30:35Z",
  "published": "2024-01-16T18:31:09Z",
  "aliases": [
    "CVE-2022-23179"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-gvqq-xg2j-r2p6",
-  "modified": "2024-04-17T00:30:57Z",
+  "modified": "2025-05-09T18:30:36Z",
  "published": "2024-04-17T00:30:57Z",
  "aliases": [
    "CVE-2024-21111"
@@ -19,6 +19,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21111"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.exploit-db.com/exploits/52287"
+    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2024.html"
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "LOW",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-82w9-g9wm-675r",
-  "modified": "2024-08-13T18:31:17Z",
+  "modified": "2025-05-09T18:30:36Z",
  "published": "2024-08-13T18:31:17Z",
  "aliases": [
    "CVE-2024-38193"
@@ -22,6 +22,10 @@
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38193"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.exploit-db.com/exploits/52284"
    }
  ],
  "database_specific": {
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3m4v-8v7m-fjqh",
+  "modified": "2025-05-09T18:30:37Z",
+  "published": "2025-05-09T18:30:37Z",
+  "aliases": [
+    "CVE-2025-28203"
+  ],
+  "details": "Victure RX1800 EN_V1.0.0_r12_110933 was discovered to contain a command injection vulnerability.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28203"
+    },
+    {
+      "type": "WEB",
+      "url": "https://pwnit.io/2025/02/13/finding-vulnerabilities-in-wi-fi-router"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-09T16:15:24Z"
+  }
+}
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3qjj-xgvq-44qh",
-  "modified": "2025-05-06T15:31:00Z",
+  "modified": "2025-05-09T18:30:36Z",
  "published": "2025-05-02T09:30:35Z",
  "aliases": [
    "CVE-2024-13860"
@@ -27,6 +27,10 @@
      "type": "WEB",
      "url": "https://www.buddyboss.com/platform"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.buddyboss.com/resources/buddyboss-platform-releases/2-8-51"
+    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a0ac8a41-553e-473b-82a7-226de17e472d?source=cve"
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3qvh-wj74-grpw",
+  "modified": "2025-05-09T18:30:36Z",
+  "published": "2025-05-09T18:30:36Z",
+  "aliases": [
+    "CVE-2024-13759"
+  ],
+  "details": "Local Privilege Escalation in Avira.Spotlight.Service.exe in Avira Prime 1.1.96.2 on Windows 10 x64  allows local attackers to gain system-level privileges via arbitrary file deletion",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13759"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.gendigital.com/us/en/contact-us/security-advisories/)"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-59"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-09T16:15:23Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3vr2-w427-fcqp",
+  "modified": "2025-05-09T18:30:36Z",
+  "published": "2025-05-09T18:30:36Z",
+  "aliases": [
+    "CVE-2024-13959"
+  ],
+  "details": "Link Following Local Privilege Escalation Vulnerability in TuneupSvc.exe in AVG TuneUp 24.2.16593.9844 on Windows allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging the service to delete a directory",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13959"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.gendigital.com/us/en/contact-us/security-advisories"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-59"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-09T16:15:23Z"
+  }
+}
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4hrx-7c6v-v9v5",
+  "modified": "2025-05-09T18:30:37Z",
+  "published": "2025-05-09T18:30:37Z",
+  "aliases": [
+    "CVE-2025-28201"
+  ],
+  "details": "An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain root access.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28201"
+    },
+    {
+      "type": "WEB",
+      "url": "https://pwnit.io/2025/02/13/finding-vulnerabilities-in-wi-fi-router"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-09T16:15:24Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-57f7-wfqr-87r7",
+  "modified": "2025-05-09T18:30:36Z",
+  "published": "2025-05-09T18:30:36Z",
+  "aliases": [
+    "CVE-2024-13944"
+  ],
+  "details": "Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via the creation of a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13944"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.gendigital.com/us/en/contact-us/security-advisories"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-367"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-09T16:15:23Z"
+  }
+}
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5g2m-h52j-gj53",
+  "modified": "2025-05-09T18:30:37Z",
+  "published": "2025-05-09T18:30:37Z",
+  "aliases": [
+    "CVE-2025-45513"
+  ],
+  "details": "Tenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.P2pListFilter.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-45513"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Eu21ka/cve_report/blob/master/The%20router%20Tenda%20FH451%20V1.0.0.9%20of%20Shenzhen%20Jixiang%20Tenda%20Technology%20Co.%2C%20Ltd.%20has%20a%20stack%20overflow%20vulnerability.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-09T16:15:24Z"
+  }
+}
@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6wp9-fhmq-qf9x",
+  "modified": "2025-05-09T18:30:38Z",
+  "published": "2025-05-09T18:30:38Z",
+  "aliases": [
+    "CVE-2025-46188"
+  ],
+  "details": "SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in superadmin_phpmyadmin.php.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46188"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/x6vrn/mitre/blob/main/CVE-2025-46188.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://medium.com/@bijay.kumar1857/sql-injection-to-rce-exploitation-0a5048e592be"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-09T16:15:24Z"
+  }
+}
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-6x46-2273-xjjf",
-  "modified": "2025-05-08T15:31:13Z",
+  "modified": "2025-05-09T18:30:36Z",
  "published": "2025-05-08T15:31:13Z",
  "aliases": [
    "CVE-2025-4207"
@@ -19,9 +19,17 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4207"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00011.html"
+    },
    {
      "type": "WEB",
      "url": "https://www.postgresql.org/support/security/CVE-2025-4207"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2025/05/09/3"
    }
  ],
  "database_specific": {
@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-99vm-2jmg-q6cj",
+  "modified": "2025-05-09T18:30:39Z",
+  "published": "2025-05-09T18:30:39Z",
+  "aliases": [
+    "CVE-2025-29509"
+  ],
+  "details": "Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conversation, due to opening external website in the app and the exposure of electronAPI, with a lack of filtering of URL when calling shell.openExternal().",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29509"
+    },
+    {
+      "type": "WEB",
+      "url": "https://drive.google.com/file/d/1qDztNtn2merSjYgPRLWFFXqlXM9tcrjD/view?usp=sharing"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/Suuuuuzy/b8fa2fa083793c460e3686c182f8c4d1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-09T17:15:50Z"
+  }
+}
@@ -0,0 +1,60 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c86p-w88r-qvqr",
+  "modified": "2025-05-09T18:30:39Z",
+  "published": "2025-05-09T18:30:38Z",
+  "aliases": [
+    "CVE-2025-4432"
+  ],
+  "details": "A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 2**32 packets sent or received.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4432"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/briansmith/ring/pull/2447"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/briansmith/ring/commit/ec2d3cf1d91f148c84e4806b4f0b3c98f6df3b38"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/security/cve/CVE-2025-4432"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2350655"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/briansmith/ring"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/briansmith/ring/blob/main/RELEASES.md#version-01712-2025-03-05"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0009.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-770"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-09T16:15:25Z"
+  }
+}
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cgmh-59mf-xh4r",
+  "modified": "2025-05-09T18:30:39Z",
+  "published": "2025-05-09T18:30:39Z",
+  "aliases": [
+    "CVE-2025-4481"
+  ],
+  "details": "A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /search-result.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4481"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hackerzhuo/CVE/issues/1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.308195"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.308195"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.566671"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.sourcecodester.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-09T17:15:52Z"
+  }
+}
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-crgq-r5hp-5v47",
+  "modified": "2025-05-09T18:30:37Z",
+  "published": "2025-05-09T18:30:37Z",
+  "aliases": [
+    "CVE-2025-28202"
+  ],
+  "details": "Incorrect access control in Victure RX1800 EN_V1.0.0_r12_110933 allows attackers to enable SSH and Telnet services without authentication.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28202"
+    },
+    {
+      "type": "WEB",
+      "url": "https://pwnit.io/2025/02/13/finding-vulnerabilities-in-wi-fi-router"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-09T16:15:24Z"
+  }
+}
--- a/Show More
+++ b/Show More