Publish Advisories

GHSA-2r5w-7wp5-72qw GHSA-73xw-qxgf-j8c4 GHSA-77wf-7c6r-cx8j GHSA-g9wm-f4gx-rwmf
2026-05-22 18:04:22 -07:00 · 2025-03-02 15:31:57 +00:00
parent 43123c0980
commit 3fa8eca84b
4 changed files with 186 additions and 0 deletions
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2r5w-7wp5-72qw",
+  "modified": "2025-03-02T15:30:31Z",
+  "published": "2025-03-02T15:30:31Z",
+  "aliases": [
+    "CVE-2025-1817"
+  ],
+  "details": "A vulnerability classified as problematic was found in Mini-Tmall up to 20250211. This vulnerability affects unknown code of the file /admin of the component Admin Name Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1817"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/qkdjksfkeg/cve_article/blob/main/Tmall_demo/XSS.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.298090"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.298090"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.504302"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-02T15:15:11Z"
+  }
+}
@@ -0,0 +1,45 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-73xw-qxgf-j8c4",
+  "modified": "2025-03-02T15:30:31Z",
+  "published": "2025-03-02T15:30:31Z",
+  "aliases": [
+    "CVE-2022-49733"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC\n\nThere is a small race window at snd_pcm_oss_sync() that is called from\nOSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls\nsnd_pcm_oss_make_ready() at first, then takes the params_lock mutex\nfor the rest.  When the stream is set up again by another thread\nbetween them, it leads to inconsistency, and may result in unexpected\nresults such as NULL dereference of OSS buffer as a fuzzer spotted\nrecently.\n\nThe fix is simply to cover snd_pcm_oss_make_ready() call into the same\nparams_lock mutex with snd_pcm_oss_make_ready_locked() variant.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49733"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/4051324a6dafd7053c74c475e80b3ba10ae672b0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/723ac5ab2891b6c10dd6cc78ef5456af593490eb"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/8015ef9e8a0ee5cecfd0cb6805834d007ab26f86"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/8423f0b6d513b259fdab9c9bf4aaa6188d054c2d"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/fce793a056c604b41a298317cf704dae255f1b36"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-02T15:15:11Z"
+  }
+}
@@ -0,0 +1,64 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-77wf-7c6r-cx8j",
+  "modified": "2025-03-02T15:30:31Z",
+  "published": "2025-03-02T15:30:31Z",
+  "aliases": [
+    "CVE-2025-1816"
+  ],
+  "details": "A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb. This affects the function audio_element_obu of the file libavformat/iamf_parse.c of the component IAMF File Handler. The manipulation of the argument num_parameters leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 0526535cd58444dd264e810b2f3348b4d96cff3b. It is recommended to apply a patch to fix this issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1816"
+    },
+    {
+      "type": "WEB",
+      "url": "https://ffmpeg.org"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/0526535cd58444dd264e810b2f3348b4d96cff3b"
+    },
+    {
+      "type": "WEB",
+      "url": "https://trac.ffmpeg.org/attachment/ticket/11475/poc"
+    },
+    {
+      "type": "WEB",
+      "url": "https://trac.ffmpeg.org/ticket/11475"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.298089"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.298089"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.506575"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-401"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-02T14:15:34Z"
+  }
+}
@@ -0,0 +1,25 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g9wm-f4gx-rwmf",
+  "modified": "2025-03-02T15:30:30Z",
+  "published": "2025-03-02T15:30:30Z",
+  "aliases": [
+    "CVE-2022-49045"
+  ],
+  "details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49045"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-26T07:00:41Z"
+  }
+}