diff --git a/advisories/unreviewed/2024/12/GHSA-37w5-m4jw-wvfc/GHSA-37w5-m4jw-wvfc.json b/advisories/unreviewed/2024/12/GHSA-37w5-m4jw-wvfc/GHSA-37w5-m4jw-wvfc.json index eea1f5f68a7..d273ae79e42 100644 --- a/advisories/unreviewed/2024/12/GHSA-37w5-m4jw-wvfc/GHSA-37w5-m4jw-wvfc.json +++ b/advisories/unreviewed/2024/12/GHSA-37w5-m4jw-wvfc/GHSA-37w5-m4jw-wvfc.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/12/GHSA-4jmc-cgpx-wfmf/GHSA-4jmc-cgpx-wfmf.json b/advisories/unreviewed/2024/12/GHSA-4jmc-cgpx-wfmf/GHSA-4jmc-cgpx-wfmf.json index 355449453ca..017d0c7f3bb 100644 --- a/advisories/unreviewed/2024/12/GHSA-4jmc-cgpx-wfmf/GHSA-4jmc-cgpx-wfmf.json +++ b/advisories/unreviewed/2024/12/GHSA-4jmc-cgpx-wfmf/GHSA-4jmc-cgpx-wfmf.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/12/GHSA-gh3f-64h2-9gjh/GHSA-gh3f-64h2-9gjh.json b/advisories/unreviewed/2024/12/GHSA-gh3f-64h2-9gjh/GHSA-gh3f-64h2-9gjh.json index dda37bdd40e..b5fa1ff16b5 100644 --- a/advisories/unreviewed/2024/12/GHSA-gh3f-64h2-9gjh/GHSA-gh3f-64h2-9gjh.json +++ b/advisories/unreviewed/2024/12/GHSA-gh3f-64h2-9gjh/GHSA-gh3f-64h2-9gjh.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/12/GHSA-hc38-wh54-qgvx/GHSA-hc38-wh54-qgvx.json b/advisories/unreviewed/2024/12/GHSA-hc38-wh54-qgvx/GHSA-hc38-wh54-qgvx.json index 1a4681f4404..cac8d2a3899 100644 --- a/advisories/unreviewed/2024/12/GHSA-hc38-wh54-qgvx/GHSA-hc38-wh54-qgvx.json +++ b/advisories/unreviewed/2024/12/GHSA-hc38-wh54-qgvx/GHSA-hc38-wh54-qgvx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hc38-wh54-qgvx", - "modified": "2025-01-09T21:31:28Z", + "modified": "2025-04-17T03:30:27Z", "published": "2024-12-18T09:31:35Z", "aliases": [ "CVE-2024-11614" @@ -47,6 +47,22 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:0222" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:3963" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:3964" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:3965" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:3970" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-11614" diff --git a/advisories/unreviewed/2024/12/GHSA-hmmg-5pjc-xm6h/GHSA-hmmg-5pjc-xm6h.json b/advisories/unreviewed/2024/12/GHSA-hmmg-5pjc-xm6h/GHSA-hmmg-5pjc-xm6h.json index 7adaea8d92e..7a71b4f3fde 100644 --- a/advisories/unreviewed/2024/12/GHSA-hmmg-5pjc-xm6h/GHSA-hmmg-5pjc-xm6h.json +++ b/advisories/unreviewed/2024/12/GHSA-hmmg-5pjc-xm6h/GHSA-hmmg-5pjc-xm6h.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/01/GHSA-wgq3-vq6c-fvpp/GHSA-wgq3-vq6c-fvpp.json b/advisories/unreviewed/2025/01/GHSA-wgq3-vq6c-fvpp/GHSA-wgq3-vq6c-fvpp.json index 15d99f1bbc4..10e90ba08f9 100644 --- a/advisories/unreviewed/2025/01/GHSA-wgq3-vq6c-fvpp/GHSA-wgq3-vq6c-fvpp.json +++ b/advisories/unreviewed/2025/01/GHSA-wgq3-vq6c-fvpp/GHSA-wgq3-vq6c-fvpp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wgq3-vq6c-fvpp", - "modified": "2025-01-08T09:30:38Z", + "modified": "2025-04-17T03:30:30Z", "published": "2025-01-08T09:30:38Z", "aliases": [ "CVE-2024-12045" diff --git a/advisories/unreviewed/2025/04/GHSA-573j-p665-w834/GHSA-573j-p665-w834.json b/advisories/unreviewed/2025/04/GHSA-573j-p665-w834/GHSA-573j-p665-w834.json new file mode 100644 index 00000000000..8802f41aa3a --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-573j-p665-w834/GHSA-573j-p665-w834.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-573j-p665-w834", + "modified": "2025-04-17T03:30:30Z", + "published": "2025-04-17T03:30:30Z", + "aliases": [ + "CVE-2025-31340" + ], + "details": "A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by running a malicious file.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31340" + }, + { + "type": "WEB", + "url": "https://zuso.ai/advisory/za-2025-03" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-98" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-17T03:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-9279-xrgq-m4hp/GHSA-9279-xrgq-m4hp.json b/advisories/unreviewed/2025/04/GHSA-9279-xrgq-m4hp/GHSA-9279-xrgq-m4hp.json new file mode 100644 index 00000000000..38ca42695b0 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-9279-xrgq-m4hp/GHSA-9279-xrgq-m4hp.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9279-xrgq-m4hp", + "modified": "2025-04-17T03:30:30Z", + "published": "2025-04-17T03:30:30Z", + "aliases": [ + "CVE-2025-31339" + ], + "details": "An unrestricted upload of file with dangerous type vulnerability in the course management function of Wisdom Master Pro versions 5.0 through 5.2 allows remote authenticated users to craft a malicious file.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31339" + }, + { + "type": "WEB", + "url": "https://zuso.ai/advisory/za-2025-02" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-17T03:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-g9m2-7jc6-pmvf/GHSA-g9m2-7jc6-pmvf.json b/advisories/unreviewed/2025/04/GHSA-g9m2-7jc6-pmvf/GHSA-g9m2-7jc6-pmvf.json new file mode 100644 index 00000000000..2aa6157c26e --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-g9m2-7jc6-pmvf/GHSA-g9m2-7jc6-pmvf.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g9m2-7jc6-pmvf", + "modified": "2025-04-17T03:30:30Z", + "published": "2025-04-17T03:30:30Z", + "aliases": [ + "CVE-2025-43715" + ], + "details": "Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43715" + }, + { + "type": "WEB", + "url": "https://nsis.sourceforge.io/Docs/AppendixF.html#v3.11-rl" + }, + { + "type": "WEB", + "url": "https://sourceforge.net/p/nsis/bugs/1315" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-754" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-17T03:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-rm74-9v34-j945/GHSA-rm74-9v34-j945.json b/advisories/unreviewed/2025/04/GHSA-rm74-9v34-j945/GHSA-rm74-9v34-j945.json new file mode 100644 index 00000000000..336cadb743d --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-rm74-9v34-j945/GHSA-rm74-9v34-j945.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rm74-9v34-j945", + "modified": "2025-04-17T03:30:30Z", + "published": "2025-04-17T03:30:30Z", + "aliases": [ + "CVE-2025-1290" + ], + "details": "A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and freeing of the virtio_vsock_sock structure \nduring an AF_VSOCK connect syscall can occur before a worker thread accesses it resulting in a dangling pointer and potential kernel code execution.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1290" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/b/301886931" + }, + { + "type": "WEB", + "url": "https://issuetracker.google.com/issues/301886931" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-17T01:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-w7gh-f2fm-9q8r/GHSA-w7gh-f2fm-9q8r.json b/advisories/unreviewed/2025/04/GHSA-w7gh-f2fm-9q8r/GHSA-w7gh-f2fm-9q8r.json new file mode 100644 index 00000000000..8d82bec8433 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-w7gh-f2fm-9q8r/GHSA-w7gh-f2fm-9q8r.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w7gh-f2fm-9q8r", + "modified": "2025-04-17T03:30:30Z", + "published": "2025-04-17T03:30:30Z", + "aliases": [ + "CVE-2025-43717" + ], + "details": "In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postparameters.php, reflect any GET or POST parameters, leading to XSS.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43717" + }, + { + "type": "WEB", + "url": "https://github.com/pear/HTTP_Request2/commit/07925aa77e441dba0ff0fa973a09802729cb838f" + }, + { + "type": "WEB", + "url": "https://github.com/pear/HTTP_Request2/commit/265e05f9e08a28a38a57219516a8e4e2dfdbb147" + }, + { + "type": "WEB", + "url": "https://github.com/pear/HTTP_Request2/blob/b1c61b71128045734d757c4d3d436457ace80ea7/package.xml#L24" + }, + { + "type": "WEB", + "url": "https://github.com/pear/HTTP_Request2/compare/v2.6.0...v2.7.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-531" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-17T03:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-wjm4-hw2r-m766/GHSA-wjm4-hw2r-m766.json b/advisories/unreviewed/2025/04/GHSA-wjm4-hw2r-m766/GHSA-wjm4-hw2r-m766.json new file mode 100644 index 00000000000..74c44b54c22 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-wjm4-hw2r-m766/GHSA-wjm4-hw2r-m766.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wjm4-hw2r-m766", + "modified": "2025-04-17T03:30:30Z", + "published": "2025-04-17T03:30:30Z", + "aliases": [ + "CVE-2025-43708" + ], + "details": "VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowError when reference='../../../set/set[2]' is used, aka an \"insecure deserialization\" issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43708" + }, + { + "type": "WEB", + "url": "https://github.com/Gelcon/PoC-of-VisiCut2_1-Stack-Overflow-Vul" + }, + { + "type": "WEB", + "url": "https://github.com/t-oster/VisiCut" + }, + { + "type": "WEB", + "url": "https://visicut.org" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-674" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-17T01:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-xjjj-rcfc-fp6h/GHSA-xjjj-rcfc-fp6h.json b/advisories/unreviewed/2025/04/GHSA-xjjj-rcfc-fp6h/GHSA-xjjj-rcfc-fp6h.json new file mode 100644 index 00000000000..9564a260cfc --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-xjjj-rcfc-fp6h/GHSA-xjjj-rcfc-fp6h.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xjjj-rcfc-fp6h", + "modified": "2025-04-17T03:30:30Z", + "published": "2025-04-17T03:30:30Z", + "aliases": [ + "CVE-2025-31338" + ], + "details": "A missing authorization vulnerability in the retrieve teacher Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to obtain partial user data by accessing the API functionality.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31338" + }, + { + "type": "WEB", + "url": "https://zuso.ai/advisory/za-2025-01" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-17T03:15:15Z" + } +} \ No newline at end of file