From 36370c2ec9d53987dce109351a28dd4254e37ca2 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 29 Apr 2025 15:32:46 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-wf85-g3p6-xf4h.json | 21 ++++++- .../GHSA-3rqf-wg29-9x59.json | 3 +- .../GHSA-3vwh-4gr8-m2f4.json | 2 +- .../GHSA-768r-2vmx-w6mf.json | 2 +- .../GHSA-773f-hc4g-6h8g.json | 6 +- .../GHSA-84r8-w725-7j27.json | 4 +- .../GHSA-j9xm-j63v-9g3x.json | 3 +- .../GHSA-jhxp-cmcc-wrx8.json | 2 +- .../GHSA-p7c9-5xv3-c4q4.json | 2 +- .../GHSA-p8x3-m7c8-mcj5.json | 2 +- .../GHSA-qqpw-wxfv-vfcg.json | 10 +++- .../GHSA-r24r-7cxr-hmcp.json | 1 + .../GHSA-rfgc-5r25-fw46.json | 2 +- .../GHSA-vgp5-qc33-722h.json | 6 +- .../GHSA-gfcp-5456-7q6c.json | 2 +- .../GHSA-78r2-qh4g-m8q3.json | 4 +- .../GHSA-cqph-p8m6-m58v.json | 4 +- .../GHSA-h5p7-7wx6-9q49.json | 4 +- .../GHSA-jqww-pvxg-f4jw.json | 4 +- .../GHSA-jx93-fcjj-g734.json | 4 +- .../GHSA-2gp8-xhxh-8h9c.json | 15 +++-- .../GHSA-3244-vj38-xw85.json | 52 +++++++++++++++++ .../GHSA-3f85-ch4h-849r.json | 15 +++-- .../GHSA-3mvr-vp9h-cr29.json | 45 +++++++++++++++ .../GHSA-425r-hmhf-r25x.json | 15 +++-- .../GHSA-487w-xx5j-gqwc.json | 6 +- .../GHSA-4jgv-vww9-6wqw.json | 52 +++++++++++++++++ .../GHSA-53p2-vrj6-pr6p.json | 15 +++-- .../GHSA-54jr-pmx4-5pvr.json | 37 ++++++++++++ .../GHSA-5jgj-vxr6-w56j.json | 15 +++-- .../GHSA-63pj-8c5p-x939.json | 37 ++++++++++++ .../GHSA-65gg-hq36-f232.json | 15 +++-- .../GHSA-65vr-4gg3-qw3m.json | 11 +++- .../GHSA-72pc-mw67-6f3f.json | 15 +++-- .../GHSA-75cj-hgmm-jp24.json | 56 +++++++++++++++++++ .../GHSA-7m2c-3c5m-7433.json | 56 +++++++++++++++++++ .../GHSA-7m42-95vx-wx7q.json | 56 +++++++++++++++++++ .../GHSA-7wfr-865w-3mvg.json | 15 +++-- .../GHSA-86pf-577r-267c.json | 15 +++-- .../GHSA-8hvc-6h7p-6mcf.json | 37 ++++++++++++ .../GHSA-9685-44wp-34gm.json | 40 +++++++++++++ .../GHSA-9c29-h337-7mw5.json | 52 +++++++++++++++++ .../GHSA-c888-p9w6-29rv.json | 37 ++++++++++++ .../GHSA-f4cw-p89c-v458.json | 15 +++-- .../GHSA-f4pj-f2qw-57cr.json | 37 ++++++++++++ .../GHSA-gx9w-3cv3-7x4r.json | 41 ++++++++++++++ .../GHSA-h3wr-2jpv-p235.json | 36 ++++++++++++ .../GHSA-hc5j-8jrj-7v92.json | 52 +++++++++++++++++ .../GHSA-j657-7g4v-wv6h.json | 56 +++++++++++++++++++ .../GHSA-j8hf-p5v4-xpj9.json | 15 +++-- .../GHSA-jfqq-89vx-39m4.json | 56 +++++++++++++++++++ .../GHSA-jgr2-rf9j-5fh3.json | 45 +++++++++++++++ .../GHSA-jhjh-hcm6-mrcc.json | 15 +++-- .../GHSA-jv2r-997x-hv7m.json | 37 ++++++++++++ .../GHSA-p9vx-xf7x-8hp9.json | 15 +++-- .../GHSA-rwf8-w7mh-r554.json | 15 +++-- .../GHSA-v4qx-h7r5-6qc8.json | 49 ++++++++++++++++ .../GHSA-vhj2-4h8c-jc8m.json | 15 +++-- .../GHSA-vvxh-6r52-hj35.json | 37 ++++++++++++ .../GHSA-xhhw-j3h4-3x9r.json | 49 ++++++++++++++++ 60 files changed, 1298 insertions(+), 84 deletions(-) create mode 100644 advisories/unreviewed/2025/04/GHSA-3244-vj38-xw85/GHSA-3244-vj38-xw85.json create mode 100644 advisories/unreviewed/2025/04/GHSA-3mvr-vp9h-cr29/GHSA-3mvr-vp9h-cr29.json create mode 100644 advisories/unreviewed/2025/04/GHSA-4jgv-vww9-6wqw/GHSA-4jgv-vww9-6wqw.json create mode 100644 advisories/unreviewed/2025/04/GHSA-54jr-pmx4-5pvr/GHSA-54jr-pmx4-5pvr.json create mode 100644 advisories/unreviewed/2025/04/GHSA-63pj-8c5p-x939/GHSA-63pj-8c5p-x939.json create mode 100644 advisories/unreviewed/2025/04/GHSA-75cj-hgmm-jp24/GHSA-75cj-hgmm-jp24.json create mode 100644 advisories/unreviewed/2025/04/GHSA-7m2c-3c5m-7433/GHSA-7m2c-3c5m-7433.json create mode 100644 advisories/unreviewed/2025/04/GHSA-7m42-95vx-wx7q/GHSA-7m42-95vx-wx7q.json create mode 100644 advisories/unreviewed/2025/04/GHSA-8hvc-6h7p-6mcf/GHSA-8hvc-6h7p-6mcf.json create mode 100644 advisories/unreviewed/2025/04/GHSA-9685-44wp-34gm/GHSA-9685-44wp-34gm.json create mode 100644 advisories/unreviewed/2025/04/GHSA-9c29-h337-7mw5/GHSA-9c29-h337-7mw5.json create mode 100644 advisories/unreviewed/2025/04/GHSA-c888-p9w6-29rv/GHSA-c888-p9w6-29rv.json create mode 100644 advisories/unreviewed/2025/04/GHSA-f4pj-f2qw-57cr/GHSA-f4pj-f2qw-57cr.json create mode 100644 advisories/unreviewed/2025/04/GHSA-gx9w-3cv3-7x4r/GHSA-gx9w-3cv3-7x4r.json create mode 100644 advisories/unreviewed/2025/04/GHSA-h3wr-2jpv-p235/GHSA-h3wr-2jpv-p235.json create mode 100644 advisories/unreviewed/2025/04/GHSA-hc5j-8jrj-7v92/GHSA-hc5j-8jrj-7v92.json create mode 100644 advisories/unreviewed/2025/04/GHSA-j657-7g4v-wv6h/GHSA-j657-7g4v-wv6h.json create mode 100644 advisories/unreviewed/2025/04/GHSA-jfqq-89vx-39m4/GHSA-jfqq-89vx-39m4.json create mode 100644 advisories/unreviewed/2025/04/GHSA-jgr2-rf9j-5fh3/GHSA-jgr2-rf9j-5fh3.json create mode 100644 advisories/unreviewed/2025/04/GHSA-jv2r-997x-hv7m/GHSA-jv2r-997x-hv7m.json create mode 100644 advisories/unreviewed/2025/04/GHSA-v4qx-h7r5-6qc8/GHSA-v4qx-h7r5-6qc8.json create mode 100644 advisories/unreviewed/2025/04/GHSA-vvxh-6r52-hj35/GHSA-vvxh-6r52-hj35.json create mode 100644 advisories/unreviewed/2025/04/GHSA-xhhw-j3h4-3x9r/GHSA-xhhw-j3h4-3x9r.json diff --git a/advisories/unreviewed/2022/05/GHSA-wf85-g3p6-xf4h/GHSA-wf85-g3p6-xf4h.json b/advisories/unreviewed/2022/05/GHSA-wf85-g3p6-xf4h/GHSA-wf85-g3p6-xf4h.json index 7bc27d4d370..5aca58d9301 100644 --- a/advisories/unreviewed/2022/05/GHSA-wf85-g3p6-xf4h/GHSA-wf85-g3p6-xf4h.json +++ b/advisories/unreviewed/2022/05/GHSA-wf85-g3p6-xf4h/GHSA-wf85-g3p6-xf4h.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-wf85-g3p6-xf4h", - "modified": "2022-05-24T17:37:19Z", + "modified": "2025-04-29T15:31:13Z", "published": "2022-05-24T17:37:19Z", "aliases": [ "CVE-2020-29385" ], "details": "GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11 to c. The next execution in the loop will assign self->code_table[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -26,6 +31,18 @@ "type": "WEB", "url": "https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/164" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5H3GNVWMZTYZR3JBYCK57PF7PFMQBNP" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BGZVCTH5O7WBJLYXZ2UOKLYNIFPVR55D" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EANWYODLOJDFLMBH6WEKJJMQ5PKLEWML" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5H3GNVWMZTYZR3JBYCK57PF7PFMQBNP" diff --git a/advisories/unreviewed/2022/11/GHSA-3rqf-wg29-9x59/GHSA-3rqf-wg29-9x59.json b/advisories/unreviewed/2022/11/GHSA-3rqf-wg29-9x59/GHSA-3rqf-wg29-9x59.json index dc671fb9c1b..1f40bd35bc0 100644 --- a/advisories/unreviewed/2022/11/GHSA-3rqf-wg29-9x59/GHSA-3rqf-wg29-9x59.json +++ b/advisories/unreviewed/2022/11/GHSA-3rqf-wg29-9x59/GHSA-3rqf-wg29-9x59.json @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-77" + "CWE-77", + "CWE-78" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/11/GHSA-3vwh-4gr8-m2f4/GHSA-3vwh-4gr8-m2f4.json b/advisories/unreviewed/2022/11/GHSA-3vwh-4gr8-m2f4/GHSA-3vwh-4gr8-m2f4.json index 486753eaa3e..8e139612f6e 100644 --- a/advisories/unreviewed/2022/11/GHSA-3vwh-4gr8-m2f4/GHSA-3vwh-4gr8-m2f4.json +++ b/advisories/unreviewed/2022/11/GHSA-3vwh-4gr8-m2f4/GHSA-3vwh-4gr8-m2f4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3vwh-4gr8-m2f4", - "modified": "2022-11-16T19:00:25Z", + "modified": "2025-04-29T15:31:13Z", "published": "2022-11-12T12:00:29Z", "aliases": [ "CVE-2022-45193" diff --git a/advisories/unreviewed/2022/11/GHSA-768r-2vmx-w6mf/GHSA-768r-2vmx-w6mf.json b/advisories/unreviewed/2022/11/GHSA-768r-2vmx-w6mf/GHSA-768r-2vmx-w6mf.json index e93491de121..3d80833e961 100644 --- a/advisories/unreviewed/2022/11/GHSA-768r-2vmx-w6mf/GHSA-768r-2vmx-w6mf.json +++ b/advisories/unreviewed/2022/11/GHSA-768r-2vmx-w6mf/GHSA-768r-2vmx-w6mf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-768r-2vmx-w6mf", - "modified": "2022-11-22T18:30:14Z", + "modified": "2025-04-29T15:31:14Z", "published": "2022-11-18T00:30:20Z", "aliases": [ "CVE-2022-44725" diff --git a/advisories/unreviewed/2022/11/GHSA-773f-hc4g-6h8g/GHSA-773f-hc4g-6h8g.json b/advisories/unreviewed/2022/11/GHSA-773f-hc4g-6h8g/GHSA-773f-hc4g-6h8g.json index 9022262ebd5..4d85c5db518 100644 --- a/advisories/unreviewed/2022/11/GHSA-773f-hc4g-6h8g/GHSA-773f-hc4g-6h8g.json +++ b/advisories/unreviewed/2022/11/GHSA-773f-hc4g-6h8g/GHSA-773f-hc4g-6h8g.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-773f-hc4g-6h8g", - "modified": "2023-01-26T21:30:21Z", + "modified": "2025-04-29T15:31:19Z", "published": "2022-11-27T06:30:24Z", "aliases": [ "CVE-2022-45934" @@ -31,6 +31,10 @@ "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDAKCGDW6CQ6G3RZWYZJO454R3L5CTQB" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAKCGDW6CQ6G3RZWYZJO454R3L5CTQB" diff --git a/advisories/unreviewed/2022/11/GHSA-84r8-w725-7j27/GHSA-84r8-w725-7j27.json b/advisories/unreviewed/2022/11/GHSA-84r8-w725-7j27/GHSA-84r8-w725-7j27.json index 19a758f64c8..3c468d49bac 100644 --- a/advisories/unreviewed/2022/11/GHSA-84r8-w725-7j27/GHSA-84r8-w725-7j27.json +++ b/advisories/unreviewed/2022/11/GHSA-84r8-w725-7j27/GHSA-84r8-w725-7j27.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-248" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/11/GHSA-j9xm-j63v-9g3x/GHSA-j9xm-j63v-9g3x.json b/advisories/unreviewed/2022/11/GHSA-j9xm-j63v-9g3x/GHSA-j9xm-j63v-9g3x.json index be22559ebe9..5bd30e79f99 100644 --- a/advisories/unreviewed/2022/11/GHSA-j9xm-j63v-9g3x/GHSA-j9xm-j63v-9g3x.json +++ b/advisories/unreviewed/2022/11/GHSA-j9xm-j63v-9g3x/GHSA-j9xm-j63v-9g3x.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j9xm-j63v-9g3x", - "modified": "2022-11-30T21:30:23Z", + "modified": "2025-04-29T15:31:18Z", "published": "2022-11-25T18:30:24Z", "aliases": [ "CVE-2022-45475" @@ -30,6 +30,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-284", "CWE-352" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2022/11/GHSA-jhxp-cmcc-wrx8/GHSA-jhxp-cmcc-wrx8.json b/advisories/unreviewed/2022/11/GHSA-jhxp-cmcc-wrx8/GHSA-jhxp-cmcc-wrx8.json index e70ce5ca0be..c5d8bae4220 100644 --- a/advisories/unreviewed/2022/11/GHSA-jhxp-cmcc-wrx8/GHSA-jhxp-cmcc-wrx8.json +++ b/advisories/unreviewed/2022/11/GHSA-jhxp-cmcc-wrx8/GHSA-jhxp-cmcc-wrx8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jhxp-cmcc-wrx8", - "modified": "2022-11-30T21:30:23Z", + "modified": "2025-04-29T15:31:18Z", "published": "2022-11-25T18:30:24Z", "aliases": [ "CVE-2022-45476" diff --git a/advisories/unreviewed/2022/11/GHSA-p7c9-5xv3-c4q4/GHSA-p7c9-5xv3-c4q4.json b/advisories/unreviewed/2022/11/GHSA-p7c9-5xv3-c4q4/GHSA-p7c9-5xv3-c4q4.json index 18117a034ea..6b2658389c8 100644 --- a/advisories/unreviewed/2022/11/GHSA-p7c9-5xv3-c4q4/GHSA-p7c9-5xv3-c4q4.json +++ b/advisories/unreviewed/2022/11/GHSA-p7c9-5xv3-c4q4/GHSA-p7c9-5xv3-c4q4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-p7c9-5xv3-c4q4", - "modified": "2022-11-23T21:30:33Z", + "modified": "2025-04-29T15:31:16Z", "published": "2022-11-22T15:30:26Z", "aliases": [ "CVE-2022-41445" diff --git a/advisories/unreviewed/2022/11/GHSA-p8x3-m7c8-mcj5/GHSA-p8x3-m7c8-mcj5.json b/advisories/unreviewed/2022/11/GHSA-p8x3-m7c8-mcj5/GHSA-p8x3-m7c8-mcj5.json index d6c7bc54a25..112ba3bcd36 100644 --- a/advisories/unreviewed/2022/11/GHSA-p8x3-m7c8-mcj5/GHSA-p8x3-m7c8-mcj5.json +++ b/advisories/unreviewed/2022/11/GHSA-p8x3-m7c8-mcj5/GHSA-p8x3-m7c8-mcj5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-p8x3-m7c8-mcj5", - "modified": "2022-11-22T21:30:17Z", + "modified": "2025-04-29T15:31:14Z", "published": "2022-11-19T00:30:56Z", "aliases": [ "CVE-2021-37936" diff --git a/advisories/unreviewed/2022/11/GHSA-qqpw-wxfv-vfcg/GHSA-qqpw-wxfv-vfcg.json b/advisories/unreviewed/2022/11/GHSA-qqpw-wxfv-vfcg/GHSA-qqpw-wxfv-vfcg.json index 7c9c6df4257..15317e9f099 100644 --- a/advisories/unreviewed/2022/11/GHSA-qqpw-wxfv-vfcg/GHSA-qqpw-wxfv-vfcg.json +++ b/advisories/unreviewed/2022/11/GHSA-qqpw-wxfv-vfcg/GHSA-qqpw-wxfv-vfcg.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qqpw-wxfv-vfcg", - "modified": "2022-11-28T15:30:23Z", + "modified": "2025-04-29T15:31:14Z", "published": "2022-11-19T00:30:55Z", "aliases": [ "CVE-2022-30256" @@ -23,6 +23,14 @@ "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00019.html" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3VSMLJX25MXGQ6A7UPOGK7VPUVDESPHL" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NB7LDZM5AGWC5BHHQHW6CP5OFNBBKFOQ" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3VSMLJX25MXGQ6A7UPOGK7VPUVDESPHL" diff --git a/advisories/unreviewed/2022/11/GHSA-r24r-7cxr-hmcp/GHSA-r24r-7cxr-hmcp.json b/advisories/unreviewed/2022/11/GHSA-r24r-7cxr-hmcp/GHSA-r24r-7cxr-hmcp.json index 5b17389e323..61c405be369 100644 --- a/advisories/unreviewed/2022/11/GHSA-r24r-7cxr-hmcp/GHSA-r24r-7cxr-hmcp.json +++ b/advisories/unreviewed/2022/11/GHSA-r24r-7cxr-hmcp/GHSA-r24r-7cxr-hmcp.json @@ -26,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-306", "CWE-862" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2022/11/GHSA-rfgc-5r25-fw46/GHSA-rfgc-5r25-fw46.json b/advisories/unreviewed/2022/11/GHSA-rfgc-5r25-fw46/GHSA-rfgc-5r25-fw46.json index b6c41391dcd..10f1e22e6e5 100644 --- a/advisories/unreviewed/2022/11/GHSA-rfgc-5r25-fw46/GHSA-rfgc-5r25-fw46.json +++ b/advisories/unreviewed/2022/11/GHSA-rfgc-5r25-fw46/GHSA-rfgc-5r25-fw46.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rfgc-5r25-fw46", - "modified": "2022-11-30T18:30:19Z", + "modified": "2025-04-29T15:31:17Z", "published": "2022-11-25T18:30:25Z", "aliases": [ "CVE-2022-41712" diff --git a/advisories/unreviewed/2022/11/GHSA-vgp5-qc33-722h/GHSA-vgp5-qc33-722h.json b/advisories/unreviewed/2022/11/GHSA-vgp5-qc33-722h/GHSA-vgp5-qc33-722h.json index 1d55546a028..6c0c97afe3f 100644 --- a/advisories/unreviewed/2022/11/GHSA-vgp5-qc33-722h/GHSA-vgp5-qc33-722h.json +++ b/advisories/unreviewed/2022/11/GHSA-vgp5-qc33-722h/GHSA-vgp5-qc33-722h.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vgp5-qc33-722h", - "modified": "2022-12-01T18:30:47Z", + "modified": "2025-04-29T15:31:18Z", "published": "2022-11-25T21:30:26Z", "aliases": [ "CVE-2022-45225" @@ -19,6 +19,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45225" }, + { + "type": "WEB", + "url": "https://medium.com/%40just0rg/book-store-management-system-1-0-unrestricted-input-leads-to-xss-74506d42492e" + }, { "type": "WEB", "url": "https://medium.com/@just0rg/book-store-management-system-1-0-unrestricted-input-leads-to-xss-74506d42492e" diff --git a/advisories/unreviewed/2023/07/GHSA-gfcp-5456-7q6c/GHSA-gfcp-5456-7q6c.json b/advisories/unreviewed/2023/07/GHSA-gfcp-5456-7q6c/GHSA-gfcp-5456-7q6c.json index 3af3a29fd33..9d042bc1743 100644 --- a/advisories/unreviewed/2023/07/GHSA-gfcp-5456-7q6c/GHSA-gfcp-5456-7q6c.json +++ b/advisories/unreviewed/2023/07/GHSA-gfcp-5456-7q6c/GHSA-gfcp-5456-7q6c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-gfcp-5456-7q6c", - "modified": "2024-04-04T05:30:26Z", + "modified": "2025-04-29T15:31:14Z", "published": "2023-07-06T19:24:04Z", "aliases": [ "CVE-2022-36785" diff --git a/advisories/unreviewed/2025/03/GHSA-78r2-qh4g-m8q3/GHSA-78r2-qh4g-m8q3.json b/advisories/unreviewed/2025/03/GHSA-78r2-qh4g-m8q3/GHSA-78r2-qh4g-m8q3.json index 514c175c91e..d91d6e4d9f7 100644 --- a/advisories/unreviewed/2025/03/GHSA-78r2-qh4g-m8q3/GHSA-78r2-qh4g-m8q3.json +++ b/advisories/unreviewed/2025/03/GHSA-78r2-qh4g-m8q3/GHSA-78r2-qh4g-m8q3.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/03/GHSA-cqph-p8m6-m58v/GHSA-cqph-p8m6-m58v.json b/advisories/unreviewed/2025/03/GHSA-cqph-p8m6-m58v/GHSA-cqph-p8m6-m58v.json index 6e4eb0dbb25..43b4ab19718 100644 --- a/advisories/unreviewed/2025/03/GHSA-cqph-p8m6-m58v/GHSA-cqph-p8m6-m58v.json +++ b/advisories/unreviewed/2025/03/GHSA-cqph-p8m6-m58v/GHSA-cqph-p8m6-m58v.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/03/GHSA-h5p7-7wx6-9q49/GHSA-h5p7-7wx6-9q49.json b/advisories/unreviewed/2025/03/GHSA-h5p7-7wx6-9q49/GHSA-h5p7-7wx6-9q49.json index 82ada9fe580..7571ef0b7af 100644 --- a/advisories/unreviewed/2025/03/GHSA-h5p7-7wx6-9q49/GHSA-h5p7-7wx6-9q49.json +++ b/advisories/unreviewed/2025/03/GHSA-h5p7-7wx6-9q49/GHSA-h5p7-7wx6-9q49.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/03/GHSA-jqww-pvxg-f4jw/GHSA-jqww-pvxg-f4jw.json b/advisories/unreviewed/2025/03/GHSA-jqww-pvxg-f4jw/GHSA-jqww-pvxg-f4jw.json index f13bcd8bfba..287c6b67124 100644 --- a/advisories/unreviewed/2025/03/GHSA-jqww-pvxg-f4jw/GHSA-jqww-pvxg-f4jw.json +++ b/advisories/unreviewed/2025/03/GHSA-jqww-pvxg-f4jw/GHSA-jqww-pvxg-f4jw.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/03/GHSA-jx93-fcjj-g734/GHSA-jx93-fcjj-g734.json b/advisories/unreviewed/2025/03/GHSA-jx93-fcjj-g734/GHSA-jx93-fcjj-g734.json index 52d5ac44c81..c29a9509f75 100644 --- a/advisories/unreviewed/2025/03/GHSA-jx93-fcjj-g734/GHSA-jx93-fcjj-g734.json +++ b/advisories/unreviewed/2025/03/GHSA-jx93-fcjj-g734/GHSA-jx93-fcjj-g734.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-352" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/04/GHSA-2gp8-xhxh-8h9c/GHSA-2gp8-xhxh-8h9c.json b/advisories/unreviewed/2025/04/GHSA-2gp8-xhxh-8h9c/GHSA-2gp8-xhxh-8h9c.json index 35649cc7eb9..e97c7b56c8e 100644 --- a/advisories/unreviewed/2025/04/GHSA-2gp8-xhxh-8h9c/GHSA-2gp8-xhxh-8h9c.json +++ b/advisories/unreviewed/2025/04/GHSA-2gp8-xhxh-8h9c/GHSA-2gp8-xhxh-8h9c.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-2gp8-xhxh-8h9c", - "modified": "2025-04-18T15:31:38Z", + "modified": "2025-04-29T15:31:21Z", "published": "2025-04-18T15:31:38Z", "aliases": [ "CVE-2025-38152" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: core: Clear table_sz when rproc_shutdown\n\nThere is case as below could trigger kernel dump:\nUse U-Boot to start remote processor(rproc) with resource table\npublished to a fixed address by rproc. After Kernel boots up,\nstop the rproc, load a new firmware which doesn't have resource table\n,and start rproc.\n\nWhen starting rproc with a firmware not have resource table,\n`memcpy(loaded_table, rproc->cached_table, rproc->table_sz)` will\ntrigger dump, because rproc->cache_table is set to NULL during the last\nstop operation, but rproc->table_sz is still valid.\n\nThis issue is found on i.MX8MP and i.MX9.\n\nDump as below:\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000000\nMem abort info:\n ESR = 0x0000000096000004\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x04: level 0 translation fault\nData abort info:\n ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\nuser pgtable: 4k pages, 48-bit VAs, pgdp=000000010af63000\n[0000000000000000] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1] PREEMPT SMP\nModules linked in:\nCPU: 2 UID: 0 PID: 1060 Comm: sh Not tainted 6.14.0-rc7-next-20250317-dirty #38\nHardware name: NXP i.MX8MPlus EVK board (DT)\npstate: a0000005 (NzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : __pi_memcpy_generic+0x110/0x22c\nlr : rproc_start+0x88/0x1e0\nCall trace:\n __pi_memcpy_generic+0x110/0x22c (P)\n rproc_boot+0x198/0x57c\n state_store+0x40/0x104\n dev_attr_store+0x18/0x2c\n sysfs_kf_write+0x7c/0x94\n kernfs_fop_write_iter+0x120/0x1cc\n vfs_write+0x240/0x378\n ksys_write+0x70/0x108\n __arm64_sys_write+0x1c/0x28\n invoke_syscall+0x48/0x10c\n el0_svc_common.constprop.0+0xc0/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x30/0xcc\n el0t_64_sync_handler+0x10c/0x138\n el0t_64_sync+0x198/0x19c\n\nClear rproc->table_sz to address the issue.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -44,8 +49,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-18T07:15:43Z" diff --git a/advisories/unreviewed/2025/04/GHSA-3244-vj38-xw85/GHSA-3244-vj38-xw85.json b/advisories/unreviewed/2025/04/GHSA-3244-vj38-xw85/GHSA-3244-vj38-xw85.json new file mode 100644 index 00000000000..30347560923 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-3244-vj38-xw85/GHSA-3244-vj38-xw85.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3244-vj38-xw85", + "modified": "2025-04-29T15:31:52Z", + "published": "2025-04-29T15:31:52Z", + "aliases": [ + "CVE-2025-4064" + ], + "details": "A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/viewenquiry.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4064" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306501" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306501" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.559467" + }, + { + "type": "WEB", + "url": "https://www.websecurityinsights.my.id/2025/04/script-and-tools-online-travling-system.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-3f85-ch4h-849r/GHSA-3f85-ch4h-849r.json b/advisories/unreviewed/2025/04/GHSA-3f85-ch4h-849r/GHSA-3f85-ch4h-849r.json index 4c7e5cab1a3..3ad7f8d5c01 100644 --- a/advisories/unreviewed/2025/04/GHSA-3f85-ch4h-849r/GHSA-3f85-ch4h-849r.json +++ b/advisories/unreviewed/2025/04/GHSA-3f85-ch4h-849r/GHSA-3f85-ch4h-849r.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-3f85-ch4h-849r", - "modified": "2025-04-18T15:31:38Z", + "modified": "2025-04-29T15:31:21Z", "published": "2025-04-18T15:31:38Z", "aliases": [ "CVE-2025-38049" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors\n\nCommit\n\n 6eac36bb9eb0 (\"x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid\")\n\nadded logic that causes resctrl to search for the CLOSID with the fewest dirty\ncache lines when creating a new control group, if requested by the arch code.\nThis depends on the values read from the llc_occupancy counters. The logic is\napplicable to architectures where the CLOSID effectively forms part of the\nmonitoring identifier and so do not allow complete freedom to choose an unused\nmonitoring identifier for a given CLOSID.\n\nThis support missed that some platforms may not have these counters. This\ncauses a NULL pointer dereference when creating a new control group as the\narray was not allocated by dom_data_init().\n\nAs this feature isn't necessary on platforms that don't have cache occupancy\nmonitors, add this to the check that occurs when a new control group is\nallocated.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -32,8 +37,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-18T07:15:43Z" diff --git a/advisories/unreviewed/2025/04/GHSA-3mvr-vp9h-cr29/GHSA-3mvr-vp9h-cr29.json b/advisories/unreviewed/2025/04/GHSA-3mvr-vp9h-cr29/GHSA-3mvr-vp9h-cr29.json new file mode 100644 index 00000000000..675cdf6380a --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-3mvr-vp9h-cr29/GHSA-3mvr-vp9h-cr29.json @@ -0,0 +1,45 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3mvr-vp9h-cr29", + "modified": "2025-04-29T15:31:53Z", + "published": "2025-04-29T15:31:53Z", + "aliases": [ + "CVE-2025-4087" + ], + "details": "A vulnerability was identified in Firefox where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and Thunderbird ESR < 128.10.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4087" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1952465" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-28" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-29" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-31" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-32" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-425r-hmhf-r25x/GHSA-425r-hmhf-r25x.json b/advisories/unreviewed/2025/04/GHSA-425r-hmhf-r25x/GHSA-425r-hmhf-r25x.json index 48c7cff481e..c5595dc32ac 100644 --- a/advisories/unreviewed/2025/04/GHSA-425r-hmhf-r25x/GHSA-425r-hmhf-r25x.json +++ b/advisories/unreviewed/2025/04/GHSA-425r-hmhf-r25x/GHSA-425r-hmhf-r25x.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-425r-hmhf-r25x", - "modified": "2025-04-18T15:31:38Z", + "modified": "2025-04-29T15:31:22Z", "published": "2025-04-18T15:31:38Z", "aliases": [ "CVE-2025-40114" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: light: Add check for array bounds in veml6075_read_int_time_ms\n\nThe array contains only 5 elements, but the index calculated by\nveml6075_read_int_time_index can range from 0 to 7,\nwhich could lead to out-of-bounds access. The check prevents this issue.\n\nCoverity Issue\nCID 1574309: (#1 of 1): Out-of-bounds read (OVERRUN)\noverrun-local: Overrunning array veml6075_it_ms of 5 4-byte\nelements at element index 7 (byte offset 31) using\nindex int_index (which evaluates to 7)\n\nThis is hardening against potentially broken hardware. Good to have\nbut not necessary to backport.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -32,8 +37,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-129" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-18T07:15:44Z" diff --git a/advisories/unreviewed/2025/04/GHSA-487w-xx5j-gqwc/GHSA-487w-xx5j-gqwc.json b/advisories/unreviewed/2025/04/GHSA-487w-xx5j-gqwc/GHSA-487w-xx5j-gqwc.json index cc32cd7ac3e..4265b5949cd 100644 --- a/advisories/unreviewed/2025/04/GHSA-487w-xx5j-gqwc/GHSA-487w-xx5j-gqwc.json +++ b/advisories/unreviewed/2025/04/GHSA-487w-xx5j-gqwc/GHSA-487w-xx5j-gqwc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-487w-xx5j-gqwc", - "modified": "2025-04-29T12:30:21Z", + "modified": "2025-04-29T15:31:51Z", "published": "2025-04-29T12:30:21Z", "aliases": [ "CVE-2025-30194" @@ -22,6 +22,10 @@ { "type": "WEB", "url": "https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2025-02.html" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/04/29/1" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/04/GHSA-4jgv-vww9-6wqw/GHSA-4jgv-vww9-6wqw.json b/advisories/unreviewed/2025/04/GHSA-4jgv-vww9-6wqw/GHSA-4jgv-vww9-6wqw.json new file mode 100644 index 00000000000..a1ca410262e --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-4jgv-vww9-6wqw/GHSA-4jgv-vww9-6wqw.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4jgv-vww9-6wqw", + "modified": "2025-04-29T15:31:54Z", + "published": "2025-04-29T15:31:54Z", + "aliases": [ + "CVE-2025-4067" + ], + "details": "A vulnerability classified as critical has been found in ScriptAndTools Online-Travling-System 1.0. Affected is an unknown function of the file /admin/viewpackage.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4067" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306504" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306504" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.559514" + }, + { + "type": "WEB", + "url": "https://www.websecurityinsights.my.id/2025/04/script-and-tools-online-travling-system_71.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T15:15:54Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-53p2-vrj6-pr6p/GHSA-53p2-vrj6-pr6p.json b/advisories/unreviewed/2025/04/GHSA-53p2-vrj6-pr6p/GHSA-53p2-vrj6-pr6p.json index f8b3f329a36..816a66f105a 100644 --- a/advisories/unreviewed/2025/04/GHSA-53p2-vrj6-pr6p/GHSA-53p2-vrj6-pr6p.json +++ b/advisories/unreviewed/2025/04/GHSA-53p2-vrj6-pr6p/GHSA-53p2-vrj6-pr6p.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-53p2-vrj6-pr6p", - "modified": "2025-04-28T21:30:43Z", + "modified": "2025-04-29T15:31:49Z", "published": "2025-04-28T21:30:43Z", "aliases": [ "CVE-2025-45953" ], "details": "A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-384" + ], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-28T20:15:21Z" diff --git a/advisories/unreviewed/2025/04/GHSA-54jr-pmx4-5pvr/GHSA-54jr-pmx4-5pvr.json b/advisories/unreviewed/2025/04/GHSA-54jr-pmx4-5pvr/GHSA-54jr-pmx4-5pvr.json new file mode 100644 index 00000000000..c4614f3f777 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-54jr-pmx4-5pvr/GHSA-54jr-pmx4-5pvr.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-54jr-pmx4-5pvr", + "modified": "2025-04-29T15:31:53Z", + "published": "2025-04-29T15:31:53Z", + "aliases": [ + "CVE-2025-4086" + ], + "details": "A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog.\n*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 138 and Thunderbird < 138.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4086" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1945705" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-28" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-31" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-5jgj-vxr6-w56j/GHSA-5jgj-vxr6-w56j.json b/advisories/unreviewed/2025/04/GHSA-5jgj-vxr6-w56j/GHSA-5jgj-vxr6-w56j.json index d92d3c9c1ba..553c0ca291e 100644 --- a/advisories/unreviewed/2025/04/GHSA-5jgj-vxr6-w56j/GHSA-5jgj-vxr6-w56j.json +++ b/advisories/unreviewed/2025/04/GHSA-5jgj-vxr6-w56j/GHSA-5jgj-vxr6-w56j.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-5jgj-vxr6-w56j", - "modified": "2025-04-29T03:30:33Z", + "modified": "2025-04-29T15:31:51Z", "published": "2025-04-29T03:30:33Z", "aliases": [ "CVE-2025-24270" ], "details": "This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, visionOS 2.4. An attacker on the local network may be able to leak sensitive user information.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -44,8 +49,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-29T03:15:34Z" diff --git a/advisories/unreviewed/2025/04/GHSA-63pj-8c5p-x939/GHSA-63pj-8c5p-x939.json b/advisories/unreviewed/2025/04/GHSA-63pj-8c5p-x939/GHSA-63pj-8c5p-x939.json new file mode 100644 index 00000000000..582ad5416e5 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-63pj-8c5p-x939/GHSA-63pj-8c5p-x939.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-63pj-8c5p-x939", + "modified": "2025-04-29T15:31:53Z", + "published": "2025-04-29T15:31:53Z", + "aliases": [ + "CVE-2025-4090" + ], + "details": "A vulnerability existed in Firefox for Android where potentially sensitive library locations were logged via Logcat. This vulnerability affects Firefox < 138 and Thunderbird < 138.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4090" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1929478" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-28" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-31" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-65gg-hq36-f232/GHSA-65gg-hq36-f232.json b/advisories/unreviewed/2025/04/GHSA-65gg-hq36-f232/GHSA-65gg-hq36-f232.json index f839c3eab07..ae72e805f02 100644 --- a/advisories/unreviewed/2025/04/GHSA-65gg-hq36-f232/GHSA-65gg-hq36-f232.json +++ b/advisories/unreviewed/2025/04/GHSA-65gg-hq36-f232/GHSA-65gg-hq36-f232.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-65gg-hq36-f232", - "modified": "2025-04-18T15:31:38Z", + "modified": "2025-04-29T15:31:21Z", "published": "2025-04-18T15:31:38Z", "aliases": [ "CVE-2025-39728" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: samsung: Fix UBSAN panic in samsung_clk_init()\n\nWith UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to\ndereferencing `ctx->clk_data.hws` before setting\n`ctx->clk_data.num = nr_clks`. Move that up to fix the crash.\n\n UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP\n \n Call trace:\n samsung_clk_init+0x110/0x124 (P)\n samsung_clk_init+0x48/0x124 (L)\n samsung_cmu_register_one+0x3c/0xa0\n exynos_arm64_register_cmu+0x54/0x64\n __gs101_cmu_top_of_clk_init_declare+0x28/0x60\n ...", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -48,8 +53,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-129" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-18T07:15:44Z" diff --git a/advisories/unreviewed/2025/04/GHSA-65vr-4gg3-qw3m/GHSA-65vr-4gg3-qw3m.json b/advisories/unreviewed/2025/04/GHSA-65vr-4gg3-qw3m/GHSA-65vr-4gg3-qw3m.json index e0de2135454..13fbcc40b50 100644 --- a/advisories/unreviewed/2025/04/GHSA-65vr-4gg3-qw3m/GHSA-65vr-4gg3-qw3m.json +++ b/advisories/unreviewed/2025/04/GHSA-65vr-4gg3-qw3m/GHSA-65vr-4gg3-qw3m.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-65vr-4gg3-qw3m", - "modified": "2025-04-29T06:30:38Z", + "modified": "2025-04-29T15:31:51Z", "published": "2025-04-29T06:30:38Z", "aliases": [ "CVE-2024-12273" ], "details": "The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -21,7 +26,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-29T06:15:56Z" diff --git a/advisories/unreviewed/2025/04/GHSA-72pc-mw67-6f3f/GHSA-72pc-mw67-6f3f.json b/advisories/unreviewed/2025/04/GHSA-72pc-mw67-6f3f/GHSA-72pc-mw67-6f3f.json index 815aacc9255..495f7604aea 100644 --- a/advisories/unreviewed/2025/04/GHSA-72pc-mw67-6f3f/GHSA-72pc-mw67-6f3f.json +++ b/advisories/unreviewed/2025/04/GHSA-72pc-mw67-6f3f/GHSA-72pc-mw67-6f3f.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-72pc-mw67-6f3f", - "modified": "2025-04-29T03:30:33Z", + "modified": "2025-04-29T15:31:51Z", "published": "2025-04-29T03:30:33Z", "aliases": [ "CVE-2025-24271" ], "details": "An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, visionOS 2.4. An unauthenticated user on the same network as a signed-in Mac could send it AirPlay commands without pairing.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [], "references": [ { @@ -44,8 +49,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-29T03:15:34Z" diff --git a/advisories/unreviewed/2025/04/GHSA-75cj-hgmm-jp24/GHSA-75cj-hgmm-jp24.json b/advisories/unreviewed/2025/04/GHSA-75cj-hgmm-jp24/GHSA-75cj-hgmm-jp24.json new file mode 100644 index 00000000000..f288ec06af9 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-75cj-hgmm-jp24/GHSA-75cj-hgmm-jp24.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-75cj-hgmm-jp24", + "modified": "2025-04-29T15:31:52Z", + "published": "2025-04-29T15:31:52Z", + "aliases": [ + "CVE-2025-4062" + ], + "details": "A vulnerability has been found in code-projects Theater Seat Booking System 1.0 and classified as critical. Affected by this vulnerability is the function cancel. The manipulation of the argument cancelcustomername leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4062" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/zzzxc643/cve/blob/main/Theatre_booking_System.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306499" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306499" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.559452" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-7m2c-3c5m-7433/GHSA-7m2c-3c5m-7433.json b/advisories/unreviewed/2025/04/GHSA-7m2c-3c5m-7433/GHSA-7m2c-3c5m-7433.json new file mode 100644 index 00000000000..15102191787 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-7m2c-3c5m-7433/GHSA-7m2c-3c5m-7433.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7m2c-3c5m-7433", + "modified": "2025-04-29T15:31:52Z", + "published": "2025-04-29T15:31:51Z", + "aliases": [ + "CVE-2025-4061" + ], + "details": "A vulnerability, which was classified as critical, was found in code-projects Clothing Store Management System up to 1.0. Affected is the function add_item. The manipulation of the argument st.productname leads to stack-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4061" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/zzzxc643/cve/blob/main/Clothing_store_mgmt.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306498" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306498" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.559447" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T13:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-7m42-95vx-wx7q/GHSA-7m42-95vx-wx7q.json b/advisories/unreviewed/2025/04/GHSA-7m42-95vx-wx7q/GHSA-7m42-95vx-wx7q.json new file mode 100644 index 00000000000..3df4521cc8b --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-7m42-95vx-wx7q/GHSA-7m42-95vx-wx7q.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7m42-95vx-wx7q", + "modified": "2025-04-29T15:31:52Z", + "published": "2025-04-29T15:31:52Z", + "aliases": [ + "CVE-2025-4063" + ], + "details": "A vulnerability was found in code-projects Student Information Management System 1.0 and classified as critical. Affected by this issue is the function cancel. The manipulation of the argument first_name/last_name leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4063" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/zzzxc643/cve/blob/main/Student_Info_System.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306500" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306500" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.559466" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-7wfr-865w-3mvg/GHSA-7wfr-865w-3mvg.json b/advisories/unreviewed/2025/04/GHSA-7wfr-865w-3mvg/GHSA-7wfr-865w-3mvg.json index 7762cc9a002..41becc73081 100644 --- a/advisories/unreviewed/2025/04/GHSA-7wfr-865w-3mvg/GHSA-7wfr-865w-3mvg.json +++ b/advisories/unreviewed/2025/04/GHSA-7wfr-865w-3mvg/GHSA-7wfr-865w-3mvg.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-7wfr-865w-3mvg", - "modified": "2025-04-29T03:30:33Z", + "modified": "2025-04-29T15:31:50Z", "published": "2025-04-29T03:30:33Z", "aliases": [ "CVE-2025-24252" ], "details": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, visionOS 2.4. An attacker on the local network may be able to corrupt process memory.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -44,8 +49,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-416" + ], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-29T03:15:34Z" diff --git a/advisories/unreviewed/2025/04/GHSA-86pf-577r-267c/GHSA-86pf-577r-267c.json b/advisories/unreviewed/2025/04/GHSA-86pf-577r-267c/GHSA-86pf-577r-267c.json index 4264f654da2..c6dc6623240 100644 --- a/advisories/unreviewed/2025/04/GHSA-86pf-577r-267c/GHSA-86pf-577r-267c.json +++ b/advisories/unreviewed/2025/04/GHSA-86pf-577r-267c/GHSA-86pf-577r-267c.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-86pf-577r-267c", - "modified": "2025-04-29T03:30:33Z", + "modified": "2025-04-29T15:31:50Z", "published": "2025-04-29T03:30:33Z", "aliases": [ "CVE-2025-24179" ], "details": "A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, visionOS 2.3, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, macOS Sequoia 15.3, tvOS 18.3. An attacker on the local network may be able to cause a denial-of-service.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -44,8 +49,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-416" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-29T03:15:34Z" diff --git a/advisories/unreviewed/2025/04/GHSA-8hvc-6h7p-6mcf/GHSA-8hvc-6h7p-6mcf.json b/advisories/unreviewed/2025/04/GHSA-8hvc-6h7p-6mcf/GHSA-8hvc-6h7p-6mcf.json new file mode 100644 index 00000000000..682fb90e24c --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-8hvc-6h7p-6mcf/GHSA-8hvc-6h7p-6mcf.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8hvc-6h7p-6mcf", + "modified": "2025-04-29T15:31:53Z", + "published": "2025-04-29T15:31:53Z", + "aliases": [ + "CVE-2025-4085" + ], + "details": "An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges. This vulnerability affects Firefox < 138 and Thunderbird < 138.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4085" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1915280" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-28" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-31" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-9685-44wp-34gm/GHSA-9685-44wp-34gm.json b/advisories/unreviewed/2025/04/GHSA-9685-44wp-34gm/GHSA-9685-44wp-34gm.json new file mode 100644 index 00000000000..1adae3501d8 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-9685-44wp-34gm/GHSA-9685-44wp-34gm.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9685-44wp-34gm", + "modified": "2025-04-29T15:31:51Z", + "published": "2025-04-29T15:31:51Z", + "aliases": [ + "CVE-2025-4035" + ], + "details": "A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4035" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2025-4035" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2362651" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-178" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T13:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-9c29-h337-7mw5/GHSA-9c29-h337-7mw5.json b/advisories/unreviewed/2025/04/GHSA-9c29-h337-7mw5/GHSA-9c29-h337-7mw5.json new file mode 100644 index 00000000000..a42e7654645 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-9c29-h337-7mw5/GHSA-9c29-h337-7mw5.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9c29-h337-7mw5", + "modified": "2025-04-29T15:31:53Z", + "published": "2025-04-29T15:31:53Z", + "aliases": [ + "CVE-2025-4065" + ], + "details": "A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/addadvertisement.php. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4065" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306502" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306502" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.559478" + }, + { + "type": "WEB", + "url": "https://www.websecurityinsights.my.id/2025/04/script-and-tools-online-travling-system_16.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T15:15:54Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-c888-p9w6-29rv/GHSA-c888-p9w6-29rv.json b/advisories/unreviewed/2025/04/GHSA-c888-p9w6-29rv/GHSA-c888-p9w6-29rv.json new file mode 100644 index 00000000000..fd89a8b65ed --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-c888-p9w6-29rv/GHSA-c888-p9w6-29rv.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c888-p9w6-29rv", + "modified": "2025-04-29T15:31:53Z", + "published": "2025-04-29T15:31:53Z", + "aliases": [ + "CVE-2025-4093" + ], + "details": "Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 128.10 and Thunderbird ESR < 128.10.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4093" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1894100" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-29" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-32" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-f4cw-p89c-v458/GHSA-f4cw-p89c-v458.json b/advisories/unreviewed/2025/04/GHSA-f4cw-p89c-v458/GHSA-f4cw-p89c-v458.json index 5b0f753babc..4a655480bc1 100644 --- a/advisories/unreviewed/2025/04/GHSA-f4cw-p89c-v458/GHSA-f4cw-p89c-v458.json +++ b/advisories/unreviewed/2025/04/GHSA-f4cw-p89c-v458/GHSA-f4cw-p89c-v458.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-f4cw-p89c-v458", - "modified": "2025-04-28T21:30:43Z", + "modified": "2025-04-29T15:31:49Z", "published": "2025-04-28T21:30:43Z", "aliases": [ "CVE-2025-45949" ], "details": "A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely and leading to account takeover.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-384" + ], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-28T20:15:21Z" diff --git a/advisories/unreviewed/2025/04/GHSA-f4pj-f2qw-57cr/GHSA-f4pj-f2qw-57cr.json b/advisories/unreviewed/2025/04/GHSA-f4pj-f2qw-57cr/GHSA-f4pj-f2qw-57cr.json new file mode 100644 index 00000000000..1db737a092c --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-f4pj-f2qw-57cr/GHSA-f4pj-f2qw-57cr.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f4pj-f2qw-57cr", + "modified": "2025-04-29T15:31:53Z", + "published": "2025-04-29T15:31:53Z", + "aliases": [ + "CVE-2025-4089" + ], + "details": "Due to insufficient escaping of special characters in the \"copy as cURL\" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox < 138 and Thunderbird < 138.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4089" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1949994%2C1956698%2C1960198" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-28" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-31" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-gx9w-3cv3-7x4r/GHSA-gx9w-3cv3-7x4r.json b/advisories/unreviewed/2025/04/GHSA-gx9w-3cv3-7x4r/GHSA-gx9w-3cv3-7x4r.json new file mode 100644 index 00000000000..97a58988134 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-gx9w-3cv3-7x4r/GHSA-gx9w-3cv3-7x4r.json @@ -0,0 +1,41 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gx9w-3cv3-7x4r", + "modified": "2025-04-29T15:31:52Z", + "published": "2025-04-29T15:31:52Z", + "aliases": [ + "CVE-2025-4084" + ], + "details": "Due to insufficient escaping of the special characters in the \"copy as cURL\" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system.\n*This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.* This vulnerability affects Firefox ESR < 128.10, Firefox ESR < 115.23, and Thunderbird ESR < 128.10.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4084" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1949994%2C1956698%2C1960198" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-29" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-30" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-32" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-h3wr-2jpv-p235/GHSA-h3wr-2jpv-p235.json b/advisories/unreviewed/2025/04/GHSA-h3wr-2jpv-p235/GHSA-h3wr-2jpv-p235.json new file mode 100644 index 00000000000..55e8d99367c --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-h3wr-2jpv-p235/GHSA-h3wr-2jpv-p235.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h3wr-2jpv-p235", + "modified": "2025-04-29T15:31:52Z", + "published": "2025-04-29T15:31:52Z", + "aliases": [ + "CVE-2025-3301" + ], + "details": "DPA countermeasures are unavailable for ECDH key agreement and EdDSA signing operations on Curve25519 and Curve448 on all Series 2 modules and SoCs due to a lack of hardware and software support. A successful DPA attack may result in exposure of confidential information. The best practice is to use the impacted crypto curves and operations with ephemeral keys to reduce the number of DPA traces that can be collected.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3301" + }, + { + "type": "WEB", + "url": "https://community.silabs.com/068Vm00000O8qbY" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1255" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-hc5j-8jrj-7v92/GHSA-hc5j-8jrj-7v92.json b/advisories/unreviewed/2025/04/GHSA-hc5j-8jrj-7v92/GHSA-hc5j-8jrj-7v92.json new file mode 100644 index 00000000000..2de14907a1d --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-hc5j-8jrj-7v92/GHSA-hc5j-8jrj-7v92.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hc5j-8jrj-7v92", + "modified": "2025-04-29T15:31:54Z", + "published": "2025-04-29T15:31:54Z", + "aliases": [ + "CVE-2025-4066" + ], + "details": "A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/addpackage.php. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4066" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306503" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306503" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.559480" + }, + { + "type": "WEB", + "url": "https://www.websecurityinsights.my.id/2025/04/script-and-tools-online-travling-system_82.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T15:15:54Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-j657-7g4v-wv6h/GHSA-j657-7g4v-wv6h.json b/advisories/unreviewed/2025/04/GHSA-j657-7g4v-wv6h/GHSA-j657-7g4v-wv6h.json new file mode 100644 index 00000000000..14dc20f0049 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-j657-7g4v-wv6h/GHSA-j657-7g4v-wv6h.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j657-7g4v-wv6h", + "modified": "2025-04-29T15:31:52Z", + "published": "2025-04-29T15:31:52Z", + "aliases": [ + "CVE-2025-2817" + ], + "details": "Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird ESR < 128.10.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2817" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1917536" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-28" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-29" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-30" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-31" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-32" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-j8hf-p5v4-xpj9/GHSA-j8hf-p5v4-xpj9.json b/advisories/unreviewed/2025/04/GHSA-j8hf-p5v4-xpj9/GHSA-j8hf-p5v4-xpj9.json index 2b5c99282db..704d7b5a5e5 100644 --- a/advisories/unreviewed/2025/04/GHSA-j8hf-p5v4-xpj9/GHSA-j8hf-p5v4-xpj9.json +++ b/advisories/unreviewed/2025/04/GHSA-j8hf-p5v4-xpj9/GHSA-j8hf-p5v4-xpj9.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-j8hf-p5v4-xpj9", - "modified": "2025-04-29T03:30:33Z", + "modified": "2025-04-29T15:31:51Z", "published": "2025-04-29T03:30:33Z", "aliases": [ "CVE-2025-31197" ], "details": "The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, visionOS 2.4. An attacker on the local network may cause an unexpected app termination.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -44,8 +49,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-400" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-29T03:15:34Z" diff --git a/advisories/unreviewed/2025/04/GHSA-jfqq-89vx-39m4/GHSA-jfqq-89vx-39m4.json b/advisories/unreviewed/2025/04/GHSA-jfqq-89vx-39m4/GHSA-jfqq-89vx-39m4.json new file mode 100644 index 00000000000..b98ecab4c0d --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-jfqq-89vx-39m4/GHSA-jfqq-89vx-39m4.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jfqq-89vx-39m4", + "modified": "2025-04-29T15:31:52Z", + "published": "2025-04-29T15:31:52Z", + "aliases": [ + "CVE-2025-4060" + ], + "details": "A vulnerability, which was classified as critical, has been found in PHPGurukul Notice Board System 1.0. This issue affects some unknown processing of the file /category.php. The manipulation of the argument catname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4060" + }, + { + "type": "WEB", + "url": "https://github.com/Q3qc1n/myCVE/issues/6" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306497" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306497" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.559361" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T13:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-jgr2-rf9j-5fh3/GHSA-jgr2-rf9j-5fh3.json b/advisories/unreviewed/2025/04/GHSA-jgr2-rf9j-5fh3/GHSA-jgr2-rf9j-5fh3.json new file mode 100644 index 00000000000..2baff67661d --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-jgr2-rf9j-5fh3/GHSA-jgr2-rf9j-5fh3.json @@ -0,0 +1,45 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jgr2-rf9j-5fh3", + "modified": "2025-04-29T15:31:53Z", + "published": "2025-04-29T15:31:53Z", + "aliases": [ + "CVE-2025-4091" + ], + "details": "Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and Thunderbird ESR < 128.10.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4091" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1951161%2C1952105" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-28" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-29" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-31" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-32" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-jhjh-hcm6-mrcc/GHSA-jhjh-hcm6-mrcc.json b/advisories/unreviewed/2025/04/GHSA-jhjh-hcm6-mrcc/GHSA-jhjh-hcm6-mrcc.json index bbe16fae335..ff047147be4 100644 --- a/advisories/unreviewed/2025/04/GHSA-jhjh-hcm6-mrcc/GHSA-jhjh-hcm6-mrcc.json +++ b/advisories/unreviewed/2025/04/GHSA-jhjh-hcm6-mrcc/GHSA-jhjh-hcm6-mrcc.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-jhjh-hcm6-mrcc", - "modified": "2025-04-18T15:31:38Z", + "modified": "2025-04-29T15:31:21Z", "published": "2025-04-18T15:31:38Z", "aliases": [ "CVE-2025-40014" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nobjtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq()\n\nIf speed_hz < AMD_SPI_MIN_HZ, amd_set_spi_freq() iterates over the\nentire amd_spi_freq array without breaking out early, causing 'i' to go\nbeyond the array bounds.\n\nFix that by stopping the loop when it gets to the last entry, so the low\nspeed_hz value gets clamped up to AMD_SPI_MIN_HZ.\n\nFixes the following warning with an UBSAN kernel:\n\n drivers/spi/spi-amd.o: error: objtool: amd_set_spi_freq() falls through to next function amd_spi_set_opcode()", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-129" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-18T07:15:44Z" diff --git a/advisories/unreviewed/2025/04/GHSA-jv2r-997x-hv7m/GHSA-jv2r-997x-hv7m.json b/advisories/unreviewed/2025/04/GHSA-jv2r-997x-hv7m/GHSA-jv2r-997x-hv7m.json new file mode 100644 index 00000000000..463b6e4f970 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-jv2r-997x-hv7m/GHSA-jv2r-997x-hv7m.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jv2r-997x-hv7m", + "modified": "2025-04-29T15:31:53Z", + "published": "2025-04-29T15:31:53Z", + "aliases": [ + "CVE-2025-4092" + ], + "details": "Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 138 and Thunderbird < 138.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4092" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1924108%2C1950780%2C1959367" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-28" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-31" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-p9vx-xf7x-8hp9/GHSA-p9vx-xf7x-8hp9.json b/advisories/unreviewed/2025/04/GHSA-p9vx-xf7x-8hp9/GHSA-p9vx-xf7x-8hp9.json index 5af88ea3ee7..51bac350cc8 100644 --- a/advisories/unreviewed/2025/04/GHSA-p9vx-xf7x-8hp9/GHSA-p9vx-xf7x-8hp9.json +++ b/advisories/unreviewed/2025/04/GHSA-p9vx-xf7x-8hp9/GHSA-p9vx-xf7x-8hp9.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-p9vx-xf7x-8hp9", - "modified": "2025-04-29T03:30:33Z", + "modified": "2025-04-29T15:31:50Z", "published": "2025-04-29T03:30:33Z", "aliases": [ "CVE-2025-24206" ], "details": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, visionOS 2.4. An attacker on the local network may be able to bypass authentication policy.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], "affected": [], "references": [ { @@ -44,8 +49,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-863" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-29T03:15:34Z" diff --git a/advisories/unreviewed/2025/04/GHSA-rwf8-w7mh-r554/GHSA-rwf8-w7mh-r554.json b/advisories/unreviewed/2025/04/GHSA-rwf8-w7mh-r554/GHSA-rwf8-w7mh-r554.json index 9c6bac343ed..a2da0b4a13a 100644 --- a/advisories/unreviewed/2025/04/GHSA-rwf8-w7mh-r554/GHSA-rwf8-w7mh-r554.json +++ b/advisories/unreviewed/2025/04/GHSA-rwf8-w7mh-r554/GHSA-rwf8-w7mh-r554.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-rwf8-w7mh-r554", - "modified": "2025-04-28T21:30:43Z", + "modified": "2025-04-29T15:31:49Z", "published": "2025-04-28T21:30:43Z", "aliases": [ "CVE-2025-45947" ], "details": "An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary code via the /obbs/change-password.php file of the My Account - Change Password component", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-28T20:15:21Z" diff --git a/advisories/unreviewed/2025/04/GHSA-v4qx-h7r5-6qc8/GHSA-v4qx-h7r5-6qc8.json b/advisories/unreviewed/2025/04/GHSA-v4qx-h7r5-6qc8/GHSA-v4qx-h7r5-6qc8.json new file mode 100644 index 00000000000..fe5037ff2a4 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-v4qx-h7r5-6qc8/GHSA-v4qx-h7r5-6qc8.json @@ -0,0 +1,49 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v4qx-h7r5-6qc8", + "modified": "2025-04-29T15:31:53Z", + "published": "2025-04-29T15:31:52Z", + "aliases": [ + "CVE-2025-4083" + ], + "details": "A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird ESR < 128.10.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4083" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1958350" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-28" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-29" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-30" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-31" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-32" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-vhj2-4h8c-jc8m/GHSA-vhj2-4h8c-jc8m.json b/advisories/unreviewed/2025/04/GHSA-vhj2-4h8c-jc8m/GHSA-vhj2-4h8c-jc8m.json index 0c3c4103376..8f5c953969d 100644 --- a/advisories/unreviewed/2025/04/GHSA-vhj2-4h8c-jc8m/GHSA-vhj2-4h8c-jc8m.json +++ b/advisories/unreviewed/2025/04/GHSA-vhj2-4h8c-jc8m/GHSA-vhj2-4h8c-jc8m.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-vhj2-4h8c-jc8m", - "modified": "2025-04-29T03:30:33Z", + "modified": "2025-04-29T15:31:50Z", "published": "2025-04-29T03:30:33Z", "aliases": [ "CVE-2025-24251" ], "details": "The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, watchOS 11.4, visionOS 2.4. An attacker on the local network may cause an unexpected app termination.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -48,8 +53,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-400" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-29T03:15:34Z" diff --git a/advisories/unreviewed/2025/04/GHSA-vvxh-6r52-hj35/GHSA-vvxh-6r52-hj35.json b/advisories/unreviewed/2025/04/GHSA-vvxh-6r52-hj35/GHSA-vvxh-6r52-hj35.json new file mode 100644 index 00000000000..aceefe56867 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-vvxh-6r52-hj35/GHSA-vvxh-6r52-hj35.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vvxh-6r52-hj35", + "modified": "2025-04-29T15:31:53Z", + "published": "2025-04-29T15:31:53Z", + "aliases": [ + "CVE-2025-4088" + ], + "details": "A security vulnerability in Firefox allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins. This vulnerability affects Firefox < 138 and Thunderbird < 138.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4088" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1953521" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-28" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-31" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-xhhw-j3h4-3x9r/GHSA-xhhw-j3h4-3x9r.json b/advisories/unreviewed/2025/04/GHSA-xhhw-j3h4-3x9r/GHSA-xhhw-j3h4-3x9r.json new file mode 100644 index 00000000000..82306babed1 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-xhhw-j3h4-3x9r/GHSA-xhhw-j3h4-3x9r.json @@ -0,0 +1,49 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xhhw-j3h4-3x9r", + "modified": "2025-04-29T15:31:52Z", + "published": "2025-04-29T15:31:52Z", + "aliases": [ + "CVE-2025-4082" + ], + "details": "Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges.\n*This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird ESR < 128.10.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4082" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1937097" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-28" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-29" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-30" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-31" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-32" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-29T14:15:34Z" + } +} \ No newline at end of file