netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-7g3r-xw9r-8hgv
GHSA-cwwg-82jm-w98g
GHSA-jx6p-9c26-g373
GHSA-v35v-mpjj-v438
GHSA-v77m-x7vq-cw6f
GHSA-vhwf-7672-qwrx
GHSA-vmg3-6qh8-v3m9
This commit is contained in:
advisory-database[bot]
2025-03-03 06:32:28 +00:00
parent 1b2b55d39b
commit 40c829b015
7 changed files with 364 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/03/GHSA-7g3r-xw9r-8hgv/GHSA-7g3r-xw9r-8hgv.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7g3r-xw9r-8hgv",
"modified": "2025-03-03T06:30:34Z",
"published": "2025-03-03T06:30:34Z",
"aliases": [
"CVE-2025-1848"
],
"details": "A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is an unknown function of the file /import_data_check. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1848"
},
{
"type": "WEB",
"url": "https://github.com/caigo8/CVE-md/blob/main/zz/zz_import_data_check_SSRF.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.298116"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.298116"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.505345"
}
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-03T04:15:08Z"
}
}
advisories/unreviewed/2025/03/GHSA-cwwg-82jm-w98g/GHSA-cwwg-82jm-w98g.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cwwg-82jm-w98g",
"modified": "2025-03-03T06:30:34Z",
"published": "2025-03-03T06:30:34Z",
"aliases": [
"CVE-2025-1851"
],
"details": "A vulnerability, which was classified as critical, was found in Tenda AC7 up to 15.03.06.44. This affects the function formSetFirewallCfg of the file /goform/SetFirewallCfg. The manipulation of the argument firewallEn leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1851"
},
{
"type": "WEB",
"url": "https://github.com/Raining-101/IOT_cve/blob/main/ac7_V15.03.06.44_SetFirewallCfg.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.298119"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.298119"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.505271"
},
{
"type": "WEB",
"url": "https://www.tenda.com.cn"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-03T05:15:10Z"
}
}
advisories/unreviewed/2025/03/GHSA-jx6p-9c26-g373/GHSA-jx6p-9c26-g373.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jx6p-9c26-g373",
"modified": "2025-03-03T06:30:34Z",
"published": "2025-03-03T06:30:34Z",
"aliases": [
"CVE-2025-27590"
],
"details": "In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27590"
},
{
"type": "WEB",
"url": "https://github.com/ytti/oxidized-web/commit/a5220a0ddc57b85cd122bffee228d3ed4901668e"
},
{
"type": "WEB",
"url": "https://github.com/ytti/oxidized-web/releases/tag/0.15.0"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-03T04:15:09Z"
}
}
advisories/unreviewed/2025/03/GHSA-v35v-mpjj-v438/GHSA-v35v-mpjj-v438.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v35v-mpjj-v438",
"modified": "2025-03-03T06:30:34Z",
"published": "2025-03-03T06:30:34Z",
"aliases": [
"CVE-2025-1852"
],
"details": "A vulnerability has been found in Totolink EX1800T 9.1.0cu.2112_B20220316 and classified as critical. This vulnerability affects the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1852"
},
{
"type": "WEB",
"url": "https://github.com/watermelon-happy/cve/blob/main/ex1800tCVE.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.298120"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.298120"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.505362"
},
{
"type": "WEB",
"url": "https://www.totolink.net"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-03T06:15:21Z"
}
}
advisories/unreviewed/2025/03/GHSA-v77m-x7vq-cw6f/GHSA-v77m-x7vq-cw6f.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v77m-x7vq-cw6f",
"modified": "2025-03-03T06:30:34Z",
"published": "2025-03-03T06:30:34Z",
"aliases": [
"CVE-2025-1849"
],
"details": "A vulnerability classified as critical was found in zj1983 zz up to 2024-8. Affected by this vulnerability is an unknown functionality of the file /import_data_todb. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1849"
},
{
"type": "WEB",
"url": "https://github.com/caigo8/CVE-md/blob/main/zz/zz_import_data_todb_SSRF.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.298117"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.298117"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.505346"
}
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-03T04:15:08Z"
}
}
advisories/unreviewed/2025/03/GHSA-vhwf-7672-qwrx/GHSA-vhwf-7672-qwrx.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vhwf-7672-qwrx",
"modified": "2025-03-03T06:30:34Z",
"published": "2025-03-03T06:30:34Z",
"aliases": [
"CVE-2025-1850"
],
"details": "A vulnerability, which was classified as critical, has been found in Codezips College Management System 1.0. Affected by this issue is some unknown functionality of the file /university.php. The manipulation of the argument book_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1850"
},
{
"type": "WEB",
"url": "https://github.com/WHOAMI-xiaoyu/CVE/blob/main/CVE_2.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.298118"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.298118"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.511626"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-03T05:15:10Z"
}
}
advisories/unreviewed/2025/03/GHSA-vmg3-6qh8-v3m9/GHSA-vmg3-6qh8-v3m9.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vmg3-6qh8-v3m9",
"modified": "2025-03-03T06:30:34Z",
"published": "2025-03-03T06:30:34Z",
"aliases": [
"CVE-2025-1853"
],
"details": "A vulnerability was found in Tenda AC8 16.03.34.06 and classified as critical. This issue affects the function sub_49E098 of the file /goform/SetIpMacBind of the component Parameter Handler. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1853"
},
{
"type": "WEB",
"url": "https://github.com/Raining-101/IOT_cve/blob/main/tenda-ac8_sub_49E098.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.298121"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.298121"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.505374"
},
{
"type": "WEB",
"url": "https://www.tenda.com.cn"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-03T06:15:21Z"
}
}