diff --git a/advisories/github-reviewed/2025/04/GHSA-4hwx-xcc5-2hfc/GHSA-4hwx-xcc5-2hfc.json b/advisories/github-reviewed/2025/04/GHSA-4hwx-xcc5-2hfc/GHSA-4hwx-xcc5-2hfc.json new file mode 100644 index 00000000000..6f2d686adfc --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-4hwx-xcc5-2hfc/GHSA-4hwx-xcc5-2hfc.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4hwx-xcc5-2hfc", + "modified": "2025-04-07T16:38:52Z", + "published": "2025-04-07T16:38:52Z", + "aliases": [ + "CVE-2025-31475" + ], + "summary": "tarteaucitron.js allows prototype pollution via custom text injection", + "details": "A vulnerability was identified in `tarteaucitron.js`, where the `addOrUpdate` function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code or a CMS plugin to manipulate JavaScript object prototypes, leading to potential security risks such as data corruption or unintended code execution.\n\n## Impact\nAn attacker with high privileges could exploit this vulnerability to:\n- Modify object prototypes, affecting core JavaScript behavior,\n- Cause application crashes or unexpected behavior,\n- Potentially introduce further security vulnerabilities depending on the application's architecture.\n\n## Fix https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b\nThe issue was resolved by ensuring that user-controlled inputs cannot modify JavaScript object prototypes.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "tarteaucitronjs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.20.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-4hwx-xcc5-2hfc" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31475" + }, + { + "type": "WEB", + "url": "https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/AmauriC/tarteaucitron.js" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-07T16:38:52Z", + "nvd_published_at": "2025-04-07T15:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-7524-3396-fqv3/GHSA-7524-3396-fqv3.json b/advisories/github-reviewed/2025/04/GHSA-7524-3396-fqv3/GHSA-7524-3396-fqv3.json new file mode 100644 index 00000000000..d6e3b2ff72a --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-7524-3396-fqv3/GHSA-7524-3396-fqv3.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7524-3396-fqv3", + "modified": "2025-04-07T16:38:24Z", + "published": "2025-04-07T16:38:24Z", + "aliases": [ + "CVE-2025-31138" + ], + "summary": "tarteaucitron.js allows UI manipulation via unrestricted CSS injection", + "details": "A vulnerability was identified in `tarteaucitron.js`, where user-controlled inputs for element dimensions (`width` and `height`) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like `100%;height:100%;position:fixed;`, potentially covering the entire viewport and facilitating clickjacking attacks.\n\n## Impact\nAn attacker with high privileges could exploit this vulnerability to:\n- Overlay malicious UI elements on top of legitimate content,\n- Trick users into interacting with hidden elements (clickjacking),\n- Disrupt the intended functionality and accessibility of the website.\n\n## Fix https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07\nThe issue was resolved by enforcing strict validation and sanitization of user-provided CSS values to prevent unintended UI manipulation.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "tarteaucitronjs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.20.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-7524-3396-fqv3" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31138" + }, + { + "type": "WEB", + "url": "https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07" + }, + { + "type": "PACKAGE", + "url": "https://github.com/AmauriC/tarteaucitron.js" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1021" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-07T16:38:24Z", + "nvd_published_at": "2025-04-07T15:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-q7g5-jq6p-6wvx/GHSA-q7g5-jq6p-6wvx.json b/advisories/github-reviewed/2025/04/GHSA-q7g5-jq6p-6wvx/GHSA-q7g5-jq6p-6wvx.json new file mode 100644 index 00000000000..5913afc6f7b --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-q7g5-jq6p-6wvx/GHSA-q7g5-jq6p-6wvx.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q7g5-jq6p-6wvx", + "modified": "2025-04-07T16:37:52Z", + "published": "2025-04-07T16:37:52Z", + "aliases": [ + "CVE-2025-30373" + ], + "summary": "Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value", + "details": "### Impact\nStarting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless.\n\n### Patches\n\n### Workarounds\nDisabling http-based inputs and allow only authenticated pull-based inputs.\n\n### References", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.graylog2:graylog2-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.1.0" + }, + { + "fixed": "6.1.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q7g5-jq6p-6wvx" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30373" + }, + { + "type": "WEB", + "url": "https://github.com/Graylog2/graylog2-server/commit/31bc13d3cd6f550ec83473d0f8666cd3ebf50f10" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Graylog2/graylog2-server" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-07T16:37:52Z", + "nvd_published_at": "2025-04-07T15:15:43Z" + } +} \ No newline at end of file