From 3cf7ce146d9f84aaa1ae9922783d2e9dea5acc32 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 22 Apr 2025 06:31:38 +0000 Subject: [PATCH] Publish Advisories GHSA-63g5-x8w2-4383 GHSA-9qpg-6x42-3rc4 GHSA-267m-4582-fw66 GHSA-42rf-mpmc-c2vf GHSA-5rwm-3cc7-8wm8 GHSA-h3qf-q3hj-98c2 GHSA-hmpr-r93w-5j44 GHSA-hv4v-9j72-w5vg GHSA-qj3c-9p7w-6v83 GHSA-xjrj-hm29-qrjc --- .../GHSA-63g5-x8w2-4383.json | 4 +- .../GHSA-9qpg-6x42-3rc4.json | 10 +++- .../GHSA-267m-4582-fw66.json | 44 ++++++++++++++++ .../GHSA-42rf-mpmc-c2vf.json | 52 +++++++++++++++++++ .../GHSA-5rwm-3cc7-8wm8.json | 36 +++++++++++++ .../GHSA-h3qf-q3hj-98c2.json | 29 +++++++++++ .../GHSA-hmpr-r93w-5j44.json | 29 +++++++++++ .../GHSA-hv4v-9j72-w5vg.json | 48 +++++++++++++++++ .../GHSA-qj3c-9p7w-6v83.json | 36 +++++++++++++ .../GHSA-xjrj-hm29-qrjc.json | 6 ++- 10 files changed, 290 insertions(+), 4 deletions(-) create mode 100644 advisories/unreviewed/2025/04/GHSA-267m-4582-fw66/GHSA-267m-4582-fw66.json create mode 100644 advisories/unreviewed/2025/04/GHSA-42rf-mpmc-c2vf/GHSA-42rf-mpmc-c2vf.json create mode 100644 advisories/unreviewed/2025/04/GHSA-5rwm-3cc7-8wm8/GHSA-5rwm-3cc7-8wm8.json create mode 100644 advisories/unreviewed/2025/04/GHSA-h3qf-q3hj-98c2/GHSA-h3qf-q3hj-98c2.json create mode 100644 advisories/unreviewed/2025/04/GHSA-hmpr-r93w-5j44/GHSA-hmpr-r93w-5j44.json create mode 100644 advisories/unreviewed/2025/04/GHSA-hv4v-9j72-w5vg/GHSA-hv4v-9j72-w5vg.json create mode 100644 advisories/unreviewed/2025/04/GHSA-qj3c-9p7w-6v83/GHSA-qj3c-9p7w-6v83.json diff --git a/advisories/unreviewed/2022/12/GHSA-63g5-x8w2-4383/GHSA-63g5-x8w2-4383.json b/advisories/unreviewed/2022/12/GHSA-63g5-x8w2-4383/GHSA-63g5-x8w2-4383.json index 3c2bdbbe50e..e840de2741b 100644 --- a/advisories/unreviewed/2022/12/GHSA-63g5-x8w2-4383/GHSA-63g5-x8w2-4383.json +++ b/advisories/unreviewed/2022/12/GHSA-63g5-x8w2-4383/GHSA-63g5-x8w2-4383.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-290" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2022/12/GHSA-9qpg-6x42-3rc4/GHSA-9qpg-6x42-3rc4.json b/advisories/unreviewed/2022/12/GHSA-9qpg-6x42-3rc4/GHSA-9qpg-6x42-3rc4.json index f196aeadb64..d1f87cf4462 100644 --- a/advisories/unreviewed/2022/12/GHSA-9qpg-6x42-3rc4/GHSA-9qpg-6x42-3rc4.json +++ b/advisories/unreviewed/2022/12/GHSA-9qpg-6x42-3rc4/GHSA-9qpg-6x42-3rc4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9qpg-6x42-3rc4", - "modified": "2022-12-15T18:30:18Z", + "modified": "2025-04-22T06:30:28Z", "published": "2022-12-13T18:30:33Z", "aliases": [ "CVE-2022-31698" @@ -19,13 +19,19 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31698" }, + { + "type": "WEB", + "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1588" + }, { "type": "WEB", "url": "https://www.vmware.com/security/advisories/VMSA-2022-0030.html" } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-400" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/04/GHSA-267m-4582-fw66/GHSA-267m-4582-fw66.json b/advisories/unreviewed/2025/04/GHSA-267m-4582-fw66/GHSA-267m-4582-fw66.json new file mode 100644 index 00000000000..616c01db034 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-267m-4582-fw66/GHSA-267m-4582-fw66.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-267m-4582-fw66", + "modified": "2025-04-22T06:30:29Z", + "published": "2025-04-22T06:30:29Z", + "aliases": [ + "CVE-2025-2839" + ], + "details": "The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-import-export-lite/trunk/assets/js/wpie-export-admin.min.js" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3274100" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ca1ead-1bc5-4ccc-9034-559db27f5e82?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-22T06:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-42rf-mpmc-c2vf/GHSA-42rf-mpmc-c2vf.json b/advisories/unreviewed/2025/04/GHSA-42rf-mpmc-c2vf/GHSA-42rf-mpmc-c2vf.json new file mode 100644 index 00000000000..183c5bdc035 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-42rf-mpmc-c2vf/GHSA-42rf-mpmc-c2vf.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-42rf-mpmc-c2vf", + "modified": "2025-04-22T06:30:29Z", + "published": "2025-04-22T06:30:29Z", + "aliases": [ + "CVE-2025-3616" + ], + "details": "The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The arbitrary file upload was sufficiently patched in 11.4.5, but a capability check was added in 11.4.6 to properly prevent unauthorized limited file uploads.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3616" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/trunk/init.php#L3340" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3270279/greenshift-animation-and-page-builder-blocks/trunk/init.php" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3273212/greenshift-animation-and-page-builder-blocks/trunk/init.php" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3276168/greenshift-animation-and-page-builder-blocks/trunk/init.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0db4671e-1989-44a4-babe-ed699c7f3a52?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-22T05:15:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-5rwm-3cc7-8wm8/GHSA-5rwm-3cc7-8wm8.json b/advisories/unreviewed/2025/04/GHSA-5rwm-3cc7-8wm8/GHSA-5rwm-3cc7-8wm8.json new file mode 100644 index 00000000000..c239dbc2810 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-5rwm-3cc7-8wm8/GHSA-5rwm-3cc7-8wm8.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5rwm-3cc7-8wm8", + "modified": "2025-04-22T06:30:29Z", + "published": "2025-04-22T06:30:29Z", + "aliases": [ + "CVE-2024-46899" + ], + "details": "Hitachi Ops Center Common Services within Hitachi Ops Center Analyzer viewpoint OVF contains an authentication credentials leakage vulnerability.This issue affects Hitachi Ops Center Common Services: from 10.0.0-00 before 11.0.0-04; Hitachi Ops Center Analyzer viewpoint OVF: from 10.0.0-00 before 11.0.0-04.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46899" + }, + { + "type": "WEB", + "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-111/index.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1392" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-22T05:15:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-h3qf-q3hj-98c2/GHSA-h3qf-q3hj-98c2.json b/advisories/unreviewed/2025/04/GHSA-h3qf-q3hj-98c2/GHSA-h3qf-q3hj-98c2.json new file mode 100644 index 00000000000..8972febda4c --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-h3qf-q3hj-98c2/GHSA-h3qf-q3hj-98c2.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h3qf-q3hj-98c2", + "modified": "2025-04-22T06:30:29Z", + "published": "2025-04-22T06:30:29Z", + "aliases": [ + "CVE-2024-13569" + ], + "details": "The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13569" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/b9742440-0e36-4900-b58e-41c9854a62b2" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-22T06:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-hmpr-r93w-5j44/GHSA-hmpr-r93w-5j44.json b/advisories/unreviewed/2025/04/GHSA-hmpr-r93w-5j44/GHSA-hmpr-r93w-5j44.json new file mode 100644 index 00000000000..32072ceed01 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-hmpr-r93w-5j44/GHSA-hmpr-r93w-5j44.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hmpr-r93w-5j44", + "modified": "2025-04-22T06:30:29Z", + "published": "2025-04-22T06:30:29Z", + "aliases": [ + "CVE-2025-2594" + ], + "details": "The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2594" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/1c1be47a-d5c0-4ac1-b9fd-475b382a7d8f" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-22T06:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-hv4v-9j72-w5vg/GHSA-hv4v-9j72-w5vg.json b/advisories/unreviewed/2025/04/GHSA-hv4v-9j72-w5vg/GHSA-hv4v-9j72-w5vg.json new file mode 100644 index 00000000000..f4653c5c97e --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-hv4v-9j72-w5vg/GHSA-hv4v-9j72-w5vg.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hv4v-9j72-w5vg", + "modified": "2025-04-22T06:30:29Z", + "published": "2025-04-22T06:30:29Z", + "aliases": [ + "CVE-2025-3814" + ], + "details": "The Tax Switch for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class-name’ parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3814" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/tax-switch-for-woocommerce/tags/1.4.0/includes/class-wdevs-tax-switch-block.php#L112" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3277044" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/tax-switch-for-woocommerce/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e290f1aa-d20a-4e76-b77b-3e5b79e9d379?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-22T06:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-qj3c-9p7w-6v83/GHSA-qj3c-9p7w-6v83.json b/advisories/unreviewed/2025/04/GHSA-qj3c-9p7w-6v83/GHSA-qj3c-9p7w-6v83.json new file mode 100644 index 00000000000..368dc63c826 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-qj3c-9p7w-6v83/GHSA-qj3c-9p7w-6v83.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qj3c-9p7w-6v83", + "modified": "2025-04-22T06:30:29Z", + "published": "2025-04-22T06:30:29Z", + "aliases": [ + "CVE-2025-2300" + ], + "details": "Hitachi Ops Center Common Services within Hitachi Ops Center OVA contains an information exposure vulnerability.\nThis issue affects Hitachi Ops Center Common Services: from 11.0.3-00 before 11.0.4-00.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2300" + }, + { + "type": "WEB", + "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-112/index.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-22T05:15:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-xjrj-hm29-qrjc/GHSA-xjrj-hm29-qrjc.json b/advisories/unreviewed/2025/04/GHSA-xjrj-hm29-qrjc/GHSA-xjrj-hm29-qrjc.json index d838b5814a0..16e2a8d43c8 100644 --- a/advisories/unreviewed/2025/04/GHSA-xjrj-hm29-qrjc/GHSA-xjrj-hm29-qrjc.json +++ b/advisories/unreviewed/2025/04/GHSA-xjrj-hm29-qrjc/GHSA-xjrj-hm29-qrjc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xjrj-hm29-qrjc", - "modified": "2025-04-16T15:34:43Z", + "modified": "2025-04-22T06:30:29Z", "published": "2025-04-16T15:34:43Z", "aliases": [ "CVE-2025-22077" @@ -26,6 +26,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/7d8dfc27d90d41627c0d6ada97ed0ab57b3dae25" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/95d2b9f693ff2a1180a23d7d59acc0c4e72f4c41" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/961755d0055e0e96d1849cc0425da966c8a64e53"