netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-58xc-hpvq-8473
GHSA-8w8f-h4cm-c4pg
GHSA-p2f8-vq4r-gqg3
This commit is contained in:
advisory-database[bot]
2025-05-06 20:02:47 +00:00
parent 76d43c708f
commit 302422c167
3 changed files with 122 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/05/GHSA-58xc-hpvq-8473/GHSA-58xc-hpvq-8473.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-58xc-hpvq-8473",
"modified": "2025-05-06T20:00:17Z",
"published": "2025-05-06T20:00:17Z",
"aliases": [],
"summary": "Redox UEFI Safe API can cause heap-buffer-overflow",
"details": "ffi::nstr() should be marked unsafe, since a pointer to a buffer without a trailing 0 value will cause a heap buffer overflow.",
"severity": [],
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "redox_uefi_std"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.1.8"
},
{
"fixed": "0.1.14"
}
]
}
]
}
],
"references": [
{
"type": "PACKAGE",
"url": "https://gitlab.redox-os.org/redox-os/uefi"
},
{
"type": "WEB",
"url": "https://gitlab.redox-os.org/redox-os/uefi/-/commit/b711d47e815665b0ec8949e39292ad8e3fdd0756"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2025-0032.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2025-05-06T20:00:17Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2025/05/GHSA-8w8f-h4cm-c4pg/GHSA-8w8f-h4cm-c4pg.json → advisories/github-reviewed/2025/05/GHSA-8w8f-h4cm-c4pg/GHSA-8w8f-h4cm-c4pg.json
+34 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8w8f-h4cm-c4pg",
"modified": "2025-05-02T18:31:38Z",
"modified": "2025-05-06T19:59:54Z",
"published": "2025-05-02T18:31:38Z",
"aliases": [
"CVE-2025-4210"
],
"summary": "Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor",
"details": "A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.812.0 is able to address this issue. The name of the patch is 3d12ac8dc2282369296c3386815c00a06c6a92fe. It is recommended to upgrade the affected component.",
"severity": [
{
@@ -14,10 +15,30 @@
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/casdoor/casdoor"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.812.0"
}
]
}
]
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -27,10 +48,18 @@
"type": "WEB",
"url": "https://github.com/casdoor/casdoor/commit/3d12ac8dc2282369296c3386815c00a06c6a92fe"
},
{
"type": "PACKAGE",
"url": "https://github.com/casdoor/casdoor"
},
{
"type": "WEB",
"url": "https://github.com/casdoor/casdoor/releases/tag/v1.812.0"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3661"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.307180"
@@ -49,8 +78,8 @@
"CWE-285"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-05-06T19:59:54Z",
"nvd_published_at": "2025-05-02T16:15:36Z"
}
}
advisories/unreviewed/2025/05/GHSA-p2f8-vq4r-gqg3/GHSA-p2f8-vq4r-gqg3.json → advisories/github-reviewed/2025/05/GHSA-p2f8-vq4r-gqg3/GHSA-p2f8-vq4r-gqg3.json
+34 -5
View File
@@ -1,24 +1,53 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p2f8-vq4r-gqg3",
"modified": "2025-05-06T18:30:39Z",
"modified": "2025-05-06T20:00:44Z",
"published": "2025-05-06T18:30:39Z",
"aliases": [
"CVE-2025-4388"
],
"summary": "Liferay Portal Reflected XSS in marketplace-app-manager-web",
"details": "A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay:com.liferay.marketplace.app.manager.web"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.50"
}
]
}
]
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4388"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/0c3ab8936429a1bc48d915fdd801580de592fd9e"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4388"
@@ -29,8 +58,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-05-06T20:00:44Z",
"nvd_published_at": "2025-05-06T18:15:39Z"
}
}