Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-03-17 21:32:00 +00:00
parent de61140639
commit 2c0b09f15f
69 changed files with 1943 additions and 97 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7c8f-5r89-mjgx",
-  "modified": "2022-10-21T19:01:13Z",
+  "modified": "2025-03-17T21:30:21Z",
  "published": "2022-05-24T17:37:22Z",
  "aliases": [
    "CVE-2020-10148"
@@ -23,6 +23,10 @@
      "type": "WEB",
      "url": "https://kb.cert.org/vuls/id/843464"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.kb.cert.org/vuls/id/843464"
+    },
    {
      "type": "WEB",
      "url": "https://www.solarwinds.com/securityadvisory"
@@ -31,7 +35,8 @@
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
-      "CWE-288"
+      "CWE-288",
+      "CWE-306"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3c7c-p4m9-gwhc",
-  "modified": "2023-03-06T18:30:20Z",
+  "modified": "2025-03-17T21:30:23Z",
  "published": "2023-02-24T00:30:16Z",
  "aliases": [
    "CVE-2023-23296"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fj8r-46q3-hp4r",
-  "modified": "2023-03-03T21:30:18Z",
+  "modified": "2025-03-17T21:30:22Z",
  "published": "2023-02-23T21:30:16Z",
  "aliases": [
    "CVE-2023-23920"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fp7x-pqr7-6fpj",
-  "modified": "2023-02-28T21:30:17Z",
+  "modified": "2025-03-17T21:30:21Z",
  "published": "2023-02-18T03:30:17Z",
  "aliases": [
    "CVE-2022-40348"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-q74f-hvfr-7jqc",
-  "modified": "2023-03-06T21:30:19Z",
+  "modified": "2025-03-17T21:30:22Z",
  "published": "2023-02-24T00:30:16Z",
  "aliases": [
    "CVE-2023-23295"
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-119"
+      "CWE-119",
+      "CWE-787"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-400"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -57,7 +57,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-787"
+    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-200"
+    ],
    "severity": "LOW",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-400"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2v89-wpgr-r5vm",
-  "modified": "2025-02-21T18:31:15Z",
+  "modified": "2025-03-17T21:30:31Z",
  "published": "2025-02-21T18:31:15Z",
  "aliases": [
    "CVE-2025-25875"
  ],
  "details": "A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /message.php. The attack can use SQL injection to obtain sensitive data.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-21T18:16:12Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4f7j-px6v-m38x",
-  "modified": "2025-02-14T00:30:44Z",
+  "modified": "2025-03-17T21:30:30Z",
  "published": "2025-02-14T00:30:44Z",
  "aliases": [
    "CVE-2024-57378"
  ],
  "details": "Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability. This issue allows the unauthorized creation of internal users without assigning any existing user role, potentially leading to privilege escalation or unauthorized access to sensitive resources.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-13T22:15:11Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5p75-8vmp-h6xw",
-  "modified": "2025-02-14T00:30:45Z",
+  "modified": "2025-03-17T21:30:30Z",
  "published": "2025-02-14T00:30:45Z",
  "aliases": [
    "CVE-2024-57782"
  ],
  "details": "An issue in Docker-proxy v18.09.0 allows attackers to cause a denial of service.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-400"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-13T23:15:10Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7jh3-f4p5-7prm",
-  "modified": "2025-02-21T18:31:14Z",
+  "modified": "2025-03-17T21:30:31Z",
  "published": "2025-02-21T18:31:14Z",
  "aliases": [
    "CVE-2024-55156"
  ],
  "details": "An XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information via supplying a crafted XML-formatted event message.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-134"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-21T18:15:18Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7pxw-57qc-2vjm",
-  "modified": "2025-02-14T00:30:45Z",
+  "modified": "2025-03-17T21:30:30Z",
  "published": "2025-02-14T00:30:45Z",
  "aliases": [
    "CVE-2025-22960"
  ],
  "details": "A session hijacking vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters. Unauthenticated attackers can access exposed log files (/logs/debug/xteLog*), potentially revealing sensitive session-related information such as session IDs (sess_id) and authentication success tokens (user_check_password OK). Exploiting this flaw could allow attackers to hijack active sessions, gain unauthorized access, and escalate privileges on affected devices.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-13T23:15:10Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9rhh-9h7r-f9gf",
-  "modified": "2025-02-14T15:31:05Z",
+  "modified": "2025-03-17T21:30:31Z",
  "published": "2025-02-14T15:31:05Z",
  "aliases": [
    "CVE-2025-25740"
  ],
  "details": "D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the PSK parameter in the SetQuickVPNSettings module.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-121"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-14T15:15:13Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c442-c8m7-hp5v",
-  "modified": "2025-02-14T00:30:45Z",
+  "modified": "2025-03-17T21:30:30Z",
  "published": "2025-02-14T00:30:44Z",
  "aliases": [
    "CVE-2024-53309"
  ],
  "details": "A stack-based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when an overly long string is passed to the \"-f\" parameter. This can lead to memory corruption, potentially allowing arbitrary code execution or causing a denial of service via specially crafted input.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-121"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-13T23:15:10Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fc4h-jq3v-6rrg",
-  "modified": "2025-02-14T00:30:44Z",
+  "modified": "2025-03-17T21:30:30Z",
  "published": "2025-02-14T00:30:44Z",
  "aliases": [
    "CVE-2023-34406"
  ],
  "details": "An issue was discovered on Mercedes Benz NTG 6. A possible integer overflow exists in the user data import/export function of NTG (New Telematics Generation) 6 head units. To perform this attack, local access to USB interface of the car is needed. With prepared data, an attacker can cause the User-Data service to fail. The failed service instance will restart automatically.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-190"
+    ],
+    "severity": "LOW",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-13T23:15:09Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-g674-vjfp-rx8j",
-  "modified": "2025-02-14T18:30:51Z",
+  "modified": "2025-03-17T21:30:31Z",
  "published": "2025-02-14T18:30:51Z",
  "aliases": [
    "CVE-2024-57790"
  ],
  "details": "IXON B.V. IXrouter IX2400 (Industrial Edge Gateway) v3.0 was discovered to contain hardcoded root credentials stored in the non-volatile flash memory. This vulnerability allows physically proximate attackers to gain root access via UART or SSH.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-798"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-14T17:15:18Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-gjw5-w65f-c5gw",
-  "modified": "2025-02-21T18:31:15Z",
+  "modified": "2025-03-17T21:30:31Z",
  "published": "2025-02-21T18:31:15Z",
  "aliases": [
    "CVE-2024-57176"
  ],
  "details": "An issue in the shiroFilter function of White-Jotter project v0.2.2 allows attackers to execute a directory traversal and access sensitive endpoints via a crafted URL.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-437"
+    ],
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-21T18:15:18Z"
--- a/Show More
+++ b/Show More