netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2jpw-g3p8-3vqg
GHSA-8j5h-cxpp-7g62
GHSA-8m5h-w7m5-3jm3
GHSA-9g47-36rw-gjh2
GHSA-f2q2-pv27-hgjf
GHSA-f9cw-7mcv-gq63
GHSA-rgpp-94g2-9xpm
This commit is contained in:
advisory-database[bot]
2025-04-19 21:31:34 +00:00
parent 632bd7c679
commit 467bc1f777
7 changed files with 328 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/04/GHSA-2jpw-g3p8-3vqg/GHSA-2jpw-g3p8-3vqg.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2jpw-g3p8-3vqg",
"modified": "2025-04-19T21:30:27Z",
"published": "2025-04-19T21:30:27Z",
"aliases": [
"CVE-2025-3817"
],
"details": "A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /oews/classes/Master.php?f=delete_stock. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3817"
},
{
"type": "WEB",
"url": "https://github.com/88hsb88/cve/blob/main/sql.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.305723"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.305723"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.555607"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-19T19:15:44Z"
}
}
advisories/unreviewed/2025/04/GHSA-8j5h-cxpp-7g62/GHSA-8j5h-cxpp-7g62.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8j5h-cxpp-7g62",
"modified": "2025-04-19T21:30:28Z",
"published": "2025-04-19T21:30:28Z",
"aliases": [
"CVE-2022-47112"
],
"details": "7-Zip through 24.09 does not report an error for certain invalid xz files, involving stream flags and reserved bits.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47112"
},
{
"type": "WEB",
"url": "https://github.com/boofish/semantic-bugs"
}
],
"database_specific": {
"cwe_ids": [
"CWE-754"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-19T21:15:45Z"
}
}
advisories/unreviewed/2025/04/GHSA-8m5h-w7m5-3jm3/GHSA-8m5h-w7m5-3jm3.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8m5h-w7m5-3jm3",
"modified": "2025-04-19T21:30:27Z",
"published": "2025-04-19T21:30:27Z",
"aliases": [
"CVE-2025-43917"
],
"details": "In Pritunl Client before 1.3.4220.57, an administrator with access to /Applications can escalate privileges after uninstalling the product. Specifically, an administrator can insert a new file at the pathname of the removed pritunl-service file. This file then is executed by a LaunchDaemon as root.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43917"
},
{
"type": "WEB",
"url": "https://forum.pritunl.com/t/pritunl-client-v1-3-4220-57/3183"
}
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-19T19:15:45Z"
}
}
advisories/unreviewed/2025/04/GHSA-9g47-36rw-gjh2/GHSA-9g47-36rw-gjh2.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9g47-36rw-gjh2",
"modified": "2025-04-19T21:30:28Z",
"published": "2025-04-19T21:30:27Z",
"aliases": [
"CVE-2025-3818"
],
"details": "A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB._process_insert_query of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3818"
},
{
"type": "WEB",
"url": "https://noppgwz8if.feishu.cn/docx/TxjpddUpTokyBwxibSgcTRr7nUf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.305724"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.305724"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.555649"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-19T20:15:15Z"
}
}
advisories/unreviewed/2025/04/GHSA-f2q2-pv27-hgjf/GHSA-f2q2-pv27-hgjf.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f2q2-pv27-hgjf",
"modified": "2025-04-19T21:30:28Z",
"published": "2025-04-19T21:30:27Z",
"aliases": [
"CVE-2022-47111"
],
"details": "7-Zip through 24.09 does not report an error for certain invalid xz files, involving block flags and reserved bits.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47111"
},
{
"type": "WEB",
"url": "https://github.com/boofish/semantic-bugs"
}
],
"database_specific": {
"cwe_ids": [
"CWE-754"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-19T21:15:45Z"
}
}
advisories/unreviewed/2025/04/GHSA-f9cw-7mcv-gq63/GHSA-f9cw-7mcv-gq63.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f9cw-7mcv-gq63",
"modified": "2025-04-19T21:30:28Z",
"published": "2025-04-19T21:30:28Z",
"aliases": [
"CVE-2025-3820"
],
"details": "A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644) and classified as critical. Affected by this issue is the function cgiSysUplinkCheckSet of the file /bin/httpd. The manipulation of the argument hostIp1/hostIp2 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3820"
},
{
"type": "WEB",
"url": "https://github.com/02Tn/vul/issues/4"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.305726"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.305726"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.555728"
},
{
"type": "WEB",
"url": "https://www.tenda.com.cn"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-19T21:15:45Z"
}
}
advisories/unreviewed/2025/04/GHSA-rgpp-94g2-9xpm/GHSA-rgpp-94g2-9xpm.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rgpp-94g2-9xpm",
"modified": "2025-04-19T21:30:28Z",
"published": "2025-04-19T21:30:27Z",
"aliases": [
"CVE-2025-3819"
],
"details": "A vulnerability has been found in PHPGurukul Men Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3819"
},
{
"type": "WEB",
"url": "https://github.com/wcndy13/cve/issues/1"
},
{
"type": "WEB",
"url": "https://phpgurukul.com"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.305725"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.305725"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.555687"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-19T20:15:15Z"
}
}