From 36d190acf6246ac2f0f15a14a961a011dfecdc16 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 17 Apr 2025 09:32:41 +0000 Subject: [PATCH] Publish Advisories GHSA-6m8h-w84x-vp4m GHSA-gq47-h9vq-4rp9 GHSA-j2wh-x4mx-4v64 --- .../GHSA-6m8h-w84x-vp4m.json | 48 +++++++++++++++++++ .../GHSA-gq47-h9vq-4rp9.json | 36 ++++++++++++++ .../GHSA-j2wh-x4mx-4v64.json | 36 ++++++++++++++ 3 files changed, 120 insertions(+) create mode 100644 advisories/unreviewed/2025/04/GHSA-6m8h-w84x-vp4m/GHSA-6m8h-w84x-vp4m.json create mode 100644 advisories/unreviewed/2025/04/GHSA-gq47-h9vq-4rp9/GHSA-gq47-h9vq-4rp9.json create mode 100644 advisories/unreviewed/2025/04/GHSA-j2wh-x4mx-4v64/GHSA-j2wh-x4mx-4v64.json diff --git a/advisories/unreviewed/2025/04/GHSA-6m8h-w84x-vp4m/GHSA-6m8h-w84x-vp4m.json b/advisories/unreviewed/2025/04/GHSA-6m8h-w84x-vp4m/GHSA-6m8h-w84x-vp4m.json new file mode 100644 index 00000000000..8c25ea2e27e --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-6m8h-w84x-vp4m/GHSA-6m8h-w84x-vp4m.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6m8h-w84x-vp4m", + "modified": "2025-04-17T09:30:35Z", + "published": "2025-04-17T09:30:35Z", + "aliases": [ + "CVE-2025-3615" + ], + "details": "The Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form-submission.js script in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3615" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.0.2/assets/js/form-submission.js" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3274693" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/fluentform/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f31bd18e-57d4-4c87-8a7c-a168e7e70061?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-17T08:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-gq47-h9vq-4rp9/GHSA-gq47-h9vq-4rp9.json b/advisories/unreviewed/2025/04/GHSA-gq47-h9vq-4rp9/GHSA-gq47-h9vq-4rp9.json new file mode 100644 index 00000000000..ed20f2db3ab --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-gq47-h9vq-4rp9/GHSA-gq47-h9vq-4rp9.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gq47-h9vq-4rp9", + "modified": "2025-04-17T09:30:35Z", + "published": "2025-04-17T09:30:35Z", + "aliases": [ + "CVE-2025-2903" + ], + "details": "An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining command-line control of the operating system. This allows an attacker to gain access to sensitive data stored on the VM, install malicious software, and disrupt or disable the functionality of the VM.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2903" + }, + { + "type": "WEB", + "url": "https://portal.perforce.com/s/detail/a91PA000001Sed3YAC" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-267" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-17T07:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-j2wh-x4mx-4v64/GHSA-j2wh-x4mx-4v64.json b/advisories/unreviewed/2025/04/GHSA-j2wh-x4mx-4v64/GHSA-j2wh-x4mx-4v64.json new file mode 100644 index 00000000000..ca2ed314893 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-j2wh-x4mx-4v64/GHSA-j2wh-x4mx-4v64.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j2wh-x4mx-4v64", + "modified": "2025-04-17T09:30:35Z", + "published": "2025-04-17T09:30:35Z", + "aliases": [ + "CVE-2025-3113" + ], + "details": "A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the application’s built-in Connector functionality to access Continuous Compliance’s internal database. This allows the user to explore the internal database schema and export its data, including the properties of Connecters and Rule Sets.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3113" + }, + { + "type": "WEB", + "url": "https://portal.perforce.com/s/detail/a91PA000001SeefYAC" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-17T07:15:43Z" + } +} \ No newline at end of file