From 4ac59e308b7ce11e78ed448dc9b9167512c6d5a1 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 10 Jun 2025 03:31:44 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-rhp6-2jj3-53p2.json | 6 +- .../GHSA-fvp6-8p9w-vffq.json | 8 ++- .../GHSA-jgfj-pqpg-7r5f.json | 4 +- .../GHSA-2wc8-2pc2-v659.json | 40 +++++++++++++ .../GHSA-38cm-xhvr-78fr.json | 40 +++++++++++++ .../GHSA-3q3p-5x2r-j3hq.json | 40 +++++++++++++ .../GHSA-457f-pcj5-v75v.json | 56 +++++++++++++++++++ .../GHSA-5p5j-jvxx-4r3v.json | 40 +++++++++++++ .../GHSA-64c7-4r62-687q.json | 56 +++++++++++++++++++ .../GHSA-6m52-p2fg-w7xc.json | 40 +++++++++++++ .../GHSA-7m6h-c8wf-3h87.json | 40 +++++++++++++ .../GHSA-7w7w-qmvg-8559.json | 56 +++++++++++++++++++ .../GHSA-7xgc-5jg8-2xhx.json | 40 +++++++++++++ .../GHSA-ccpf-5wvp-w88h.json | 40 +++++++++++++ .../GHSA-gr6j-93jw-jrj6.json | 40 +++++++++++++ .../GHSA-gw6j-cw44-6794.json | 40 +++++++++++++ .../GHSA-hgfm-jj39-9pfh.json | 40 +++++++++++++ .../GHSA-hhjp-qj76-2j9m.json | 40 +++++++++++++ .../GHSA-j52j-ph84-2j62.json | 56 +++++++++++++++++++ .../GHSA-jhc2-hv2x-fj67.json | 56 +++++++++++++++++++ .../GHSA-mf43-m2mh-xcq6.json | 40 +++++++++++++ .../GHSA-p85x-xv8x-v67q.json | 40 +++++++++++++ .../GHSA-q44f-xpfq-69g2.json | 25 +++++++++ .../GHSA-q73c-hmcg-m3vx.json | 40 +++++++++++++ .../GHSA-qjqq-q9g6-p92r.json | 56 +++++++++++++++++++ .../GHSA-qr2r-6pw3-h7m4.json | 40 +++++++++++++ 26 files changed, 1015 insertions(+), 4 deletions(-) create mode 100644 advisories/unreviewed/2025/06/GHSA-2wc8-2pc2-v659/GHSA-2wc8-2pc2-v659.json create mode 100644 advisories/unreviewed/2025/06/GHSA-38cm-xhvr-78fr/GHSA-38cm-xhvr-78fr.json create mode 100644 advisories/unreviewed/2025/06/GHSA-3q3p-5x2r-j3hq/GHSA-3q3p-5x2r-j3hq.json create mode 100644 advisories/unreviewed/2025/06/GHSA-457f-pcj5-v75v/GHSA-457f-pcj5-v75v.json create mode 100644 advisories/unreviewed/2025/06/GHSA-5p5j-jvxx-4r3v/GHSA-5p5j-jvxx-4r3v.json create mode 100644 advisories/unreviewed/2025/06/GHSA-64c7-4r62-687q/GHSA-64c7-4r62-687q.json create mode 100644 advisories/unreviewed/2025/06/GHSA-6m52-p2fg-w7xc/GHSA-6m52-p2fg-w7xc.json create mode 100644 advisories/unreviewed/2025/06/GHSA-7m6h-c8wf-3h87/GHSA-7m6h-c8wf-3h87.json create mode 100644 advisories/unreviewed/2025/06/GHSA-7w7w-qmvg-8559/GHSA-7w7w-qmvg-8559.json create mode 100644 advisories/unreviewed/2025/06/GHSA-7xgc-5jg8-2xhx/GHSA-7xgc-5jg8-2xhx.json create mode 100644 advisories/unreviewed/2025/06/GHSA-ccpf-5wvp-w88h/GHSA-ccpf-5wvp-w88h.json create mode 100644 advisories/unreviewed/2025/06/GHSA-gr6j-93jw-jrj6/GHSA-gr6j-93jw-jrj6.json create mode 100644 advisories/unreviewed/2025/06/GHSA-gw6j-cw44-6794/GHSA-gw6j-cw44-6794.json create mode 100644 advisories/unreviewed/2025/06/GHSA-hgfm-jj39-9pfh/GHSA-hgfm-jj39-9pfh.json create mode 100644 advisories/unreviewed/2025/06/GHSA-hhjp-qj76-2j9m/GHSA-hhjp-qj76-2j9m.json create mode 100644 advisories/unreviewed/2025/06/GHSA-j52j-ph84-2j62/GHSA-j52j-ph84-2j62.json create mode 100644 advisories/unreviewed/2025/06/GHSA-jhc2-hv2x-fj67/GHSA-jhc2-hv2x-fj67.json create mode 100644 advisories/unreviewed/2025/06/GHSA-mf43-m2mh-xcq6/GHSA-mf43-m2mh-xcq6.json create mode 100644 advisories/unreviewed/2025/06/GHSA-p85x-xv8x-v67q/GHSA-p85x-xv8x-v67q.json create mode 100644 advisories/unreviewed/2025/06/GHSA-q44f-xpfq-69g2/GHSA-q44f-xpfq-69g2.json create mode 100644 advisories/unreviewed/2025/06/GHSA-q73c-hmcg-m3vx/GHSA-q73c-hmcg-m3vx.json create mode 100644 advisories/unreviewed/2025/06/GHSA-qjqq-q9g6-p92r/GHSA-qjqq-q9g6-p92r.json create mode 100644 advisories/unreviewed/2025/06/GHSA-qr2r-6pw3-h7m4/GHSA-qr2r-6pw3-h7m4.json diff --git a/advisories/unreviewed/2024/03/GHSA-rhp6-2jj3-53p2/GHSA-rhp6-2jj3-53p2.json b/advisories/unreviewed/2024/03/GHSA-rhp6-2jj3-53p2/GHSA-rhp6-2jj3-53p2.json index 746ab7bf48e..b0445909524 100644 --- a/advisories/unreviewed/2024/03/GHSA-rhp6-2jj3-53p2/GHSA-rhp6-2jj3-53p2.json +++ b/advisories/unreviewed/2024/03/GHSA-rhp6-2jj3-53p2/GHSA-rhp6-2jj3-53p2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rhp6-2jj3-53p2", - "modified": "2024-08-01T15:31:35Z", + "modified": "2025-06-10T03:30:28Z", "published": "2024-03-29T00:30:34Z", "aliases": [ "CVE-2024-28714" @@ -31,6 +31,10 @@ "type": "WEB", "url": "https://github.com/JiangXiaoBaiJia/cve2/blob/main/a.png" }, + { + "type": "WEB", + "url": "https://www.vicarius.io/vsociety/posts/ssti-in-mblog-351-a-tale-of-a-glorified-rce-cve-2024-28713-28714" + }, { "type": "WEB", "url": "http://crmebjava.com" diff --git a/advisories/unreviewed/2024/04/GHSA-fvp6-8p9w-vffq/GHSA-fvp6-8p9w-vffq.json b/advisories/unreviewed/2024/04/GHSA-fvp6-8p9w-vffq/GHSA-fvp6-8p9w-vffq.json index 1c2be7c19a1..c5d276ca44e 100644 --- a/advisories/unreviewed/2024/04/GHSA-fvp6-8p9w-vffq/GHSA-fvp6-8p9w-vffq.json +++ b/advisories/unreviewed/2024/04/GHSA-fvp6-8p9w-vffq/GHSA-fvp6-8p9w-vffq.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fvp6-8p9w-vffq", - "modified": "2024-04-16T18:31:36Z", + "modified": "2025-06-10T03:30:28Z", "published": "2024-04-16T18:31:36Z", "aliases": [ "CVE-2023-40000" ], - "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.\n\n", + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.", "severity": [ { "type": "CVSS_V3", @@ -19,6 +19,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40000" }, + { + "type": "WEB", + "url": "https://github.com/rxerium/CVE-2023-40000" + }, { "type": "WEB", "url": "https://patchstack.com/database/vulnerability/litespeed-cache/wordpress-litespeed-cache-plugin-5-7-unauthenticated-site-wide-stored-xss-vulnerability?_s_id=cve" diff --git a/advisories/unreviewed/2024/04/GHSA-jgfj-pqpg-7r5f/GHSA-jgfj-pqpg-7r5f.json b/advisories/unreviewed/2024/04/GHSA-jgfj-pqpg-7r5f/GHSA-jgfj-pqpg-7r5f.json index 34c738601ff..7df1d76eeba 100644 --- a/advisories/unreviewed/2024/04/GHSA-jgfj-pqpg-7r5f/GHSA-jgfj-pqpg-7r5f.json +++ b/advisories/unreviewed/2024/04/GHSA-jgfj-pqpg-7r5f/GHSA-jgfj-pqpg-7r5f.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/06/GHSA-2wc8-2pc2-v659/GHSA-2wc8-2pc2-v659.json b/advisories/unreviewed/2025/06/GHSA-2wc8-2pc2-v659/GHSA-2wc8-2pc2-v659.json new file mode 100644 index 00000000000..51135f8d430 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-2wc8-2pc2-v659/GHSA-2wc8-2pc2-v659.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2wc8-2pc2-v659", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2025-42994" + ], + "details": "SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on confidentiality and integrity of the application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42994" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3610006" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-590" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-38cm-xhvr-78fr/GHSA-38cm-xhvr-78fr.json b/advisories/unreviewed/2025/06/GHSA-38cm-xhvr-78fr/GHSA-38cm-xhvr-78fr.json new file mode 100644 index 00000000000..0636647acc6 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-38cm-xhvr-78fr/GHSA-38cm-xhvr-78fr.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-38cm-xhvr-78fr", + "modified": "2025-06-10T03:30:28Z", + "published": "2025-06-10T03:30:28Z", + "aliases": [ + "CVE-2025-23192" + ], + "details": "SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session information, modify or make browser information unavailable. This leads to a high impact on confidentiality and low impact on integrity, availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23192" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3560693" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-3q3p-5x2r-j3hq/GHSA-3q3p-5x2r-j3hq.json b/advisories/unreviewed/2025/06/GHSA-3q3p-5x2r-j3hq/GHSA-3q3p-5x2r-j3hq.json new file mode 100644 index 00000000000..7795731b624 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-3q3p-5x2r-j3hq/GHSA-3q3p-5x2r-j3hq.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3q3p-5x2r-j3hq", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2025-42995" + ], + "details": "SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on confidentiality and integrity of the application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42995" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3610006" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-590" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-457f-pcj5-v75v/GHSA-457f-pcj5-v75v.json b/advisories/unreviewed/2025/06/GHSA-457f-pcj5-v75v/GHSA-457f-pcj5-v75v.json new file mode 100644 index 00000000000..3491f5c49b9 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-457f-pcj5-v75v/GHSA-457f-pcj5-v75v.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-457f-pcj5-v75v", + "modified": "2025-06-10T03:30:30Z", + "published": "2025-06-10T03:30:30Z", + "aliases": [ + "CVE-2025-5910" + ], + "details": "A vulnerability has been found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formWsc of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5910" + }, + { + "type": "WEB", + "url": "https://github.com/byxs0x0/cve2/blob/main/6.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311683" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311683" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.592271" + }, + { + "type": "WEB", + "url": "https://www.totolink.net" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T03:15:38Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-5p5j-jvxx-4r3v/GHSA-5p5j-jvxx-4r3v.json b/advisories/unreviewed/2025/06/GHSA-5p5j-jvxx-4r3v/GHSA-5p5j-jvxx-4r3v.json new file mode 100644 index 00000000000..4ce3a3cfb5d --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-5p5j-jvxx-4r3v/GHSA-5p5j-jvxx-4r3v.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5p5j-jvxx-4r3v", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2025-42988" + ], + "details": "Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no impact on integrity and availability of the application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42988" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3585545" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-64c7-4r62-687q/GHSA-64c7-4r62-687q.json b/advisories/unreviewed/2025/06/GHSA-64c7-4r62-687q/GHSA-64c7-4r62-687q.json new file mode 100644 index 00000000000..22f588fb760 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-64c7-4r62-687q/GHSA-64c7-4r62-687q.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-64c7-4r62-687q", + "modified": "2025-06-10T03:30:30Z", + "published": "2025-06-10T03:30:30Z", + "aliases": [ + "CVE-2025-5909" + ], + "details": "A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formReflashClientTbl of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5909" + }, + { + "type": "WEB", + "url": "https://github.com/byxs0x0/cve2/blob/main/5.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311682" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311682" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.592270" + }, + { + "type": "WEB", + "url": "https://www.totolink.net" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T02:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-6m52-p2fg-w7xc/GHSA-6m52-p2fg-w7xc.json b/advisories/unreviewed/2025/06/GHSA-6m52-p2fg-w7xc/GHSA-6m52-p2fg-w7xc.json new file mode 100644 index 00000000000..9d222ead490 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-6m52-p2fg-w7xc/GHSA-6m52-p2fg-w7xc.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6m52-p2fg-w7xc", + "modified": "2025-06-10T03:30:28Z", + "published": "2025-06-10T03:30:28Z", + "aliases": [ + "CVE-2025-42983" + ], + "details": "SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to drop arbitrary SAP database tables, potentially resulting in a loss of data or rendering the system unusable. On successful exploitation, an attacker can completely delete database entries but is not able to read any data.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42983" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3606484" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-7m6h-c8wf-3h87/GHSA-7m6h-c8wf-3h87.json b/advisories/unreviewed/2025/06/GHSA-7m6h-c8wf-3h87/GHSA-7m6h-c8wf-3h87.json new file mode 100644 index 00000000000..4d0c7c3d5fa --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-7m6h-c8wf-3h87/GHSA-7m6h-c8wf-3h87.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7m6h-c8wf-3h87", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2025-42991" + ], + "details": "SAP S/4HANA (Bank Account Application) does not perform necessary authorization checks. This allows an authenticated 'approver' user to delete attachment from bank account application of other user, leading to a low impact on integrity, with no impact on the confidentiality of the data or the availability of the application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42991" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3608058" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-7w7w-qmvg-8559/GHSA-7w7w-qmvg-8559.json b/advisories/unreviewed/2025/06/GHSA-7w7w-qmvg-8559/GHSA-7w7w-qmvg-8559.json new file mode 100644 index 00000000000..2c14ca6d5ff --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-7w7w-qmvg-8559/GHSA-7w7w-qmvg-8559.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7w7w-qmvg-8559", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2025-5907" + ], + "details": "A vulnerability classified as critical was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5907" + }, + { + "type": "WEB", + "url": "https://github.com/byxs0x0/cve2/blob/main/3.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311680" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311680" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.592267" + }, + { + "type": "WEB", + "url": "https://www.totolink.net" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-7xgc-5jg8-2xhx/GHSA-7xgc-5jg8-2xhx.json b/advisories/unreviewed/2025/06/GHSA-7xgc-5jg8-2xhx/GHSA-7xgc-5jg8-2xhx.json new file mode 100644 index 00000000000..83771c31b0a --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-7xgc-5jg8-2xhx/GHSA-7xgc-5jg8-2xhx.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7xgc-5jg8-2xhx", + "modified": "2025-06-10T03:30:28Z", + "published": "2025-06-10T03:30:28Z", + "aliases": [ + "CVE-2025-42982" + ], + "details": "SAP GRC allows a non-administrative user to access and initiate transaction which could allow them to modify or control the transmitted system credentials. This causes high impact on confidentiality, integrity and availability of the application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42982" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3609271" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-ccpf-5wvp-w88h/GHSA-ccpf-5wvp-w88h.json b/advisories/unreviewed/2025/06/GHSA-ccpf-5wvp-w88h/GHSA-ccpf-5wvp-w88h.json new file mode 100644 index 00000000000..1f7531c5e9e --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-ccpf-5wvp-w88h/GHSA-ccpf-5wvp-w88h.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ccpf-5wvp-w88h", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2025-42990" + ], + "details": "Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlled URL. This issue could impact the integrity of the application. Confidentiality or Availability are not impacted.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42990" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3601169" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-gr6j-93jw-jrj6/GHSA-gr6j-93jw-jrj6.json b/advisories/unreviewed/2025/06/GHSA-gr6j-93jw-jrj6/GHSA-gr6j-93jw-jrj6.json new file mode 100644 index 00000000000..c3c4bed1874 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-gr6j-93jw-jrj6/GHSA-gr6j-93jw-jrj6.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gr6j-93jw-jrj6", + "modified": "2025-06-10T03:30:28Z", + "published": "2025-06-10T03:30:28Z", + "aliases": [ + "CVE-2025-42977" + ], + "details": "SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user. This allows an attacker to read or modify arbitrary files, resulting in a high impact on confidentiality and a low impact on integrity.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42977" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3610591" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-gw6j-cw44-6794/GHSA-gw6j-cw44-6794.json b/advisories/unreviewed/2025/06/GHSA-gw6j-cw44-6794/GHSA-gw6j-cw44-6794.json new file mode 100644 index 00000000000..50dd0df3830 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-gw6j-cw44-6794/GHSA-gw6j-cw44-6794.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gw6j-cw44-6794", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2025-42998" + ], + "details": "The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access restricted pages. This leads to low impact on confidentiality of the application, there is no impact on integrity and availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42998" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3594258" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-346" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-hgfm-jj39-9pfh/GHSA-hgfm-jj39-9pfh.json b/advisories/unreviewed/2025/06/GHSA-hgfm-jj39-9pfh/GHSA-hgfm-jj39-9pfh.json new file mode 100644 index 00000000000..3638acc4aad --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-hgfm-jj39-9pfh/GHSA-hgfm-jj39-9pfh.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hgfm-jj39-9pfh", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2025-42987" + ], + "details": "SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit shared rules of any user by tampering the request parameter. Due to missing authorization check, the attacker can edit rules that should be restricted, compromising the integrity of the application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42987" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3596850" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-hhjp-qj76-2j9m/GHSA-hhjp-qj76-2j9m.json b/advisories/unreviewed/2025/06/GHSA-hhjp-qj76-2j9m/GHSA-hhjp-qj76-2j9m.json new file mode 100644 index 00000000000..a7d0cd8d31b --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-hhjp-qj76-2j9m/GHSA-hhjp-qj76-2j9m.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hhjp-qj76-2j9m", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2025-42993" + ], + "details": "Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound Binding Configuration could create an RFC destination and assign an arbitrary high-privilege user. This allows the attacker to consume events via the RFC destination, leading to code execution under the privileges of the assigned high-privilege user. While the vulnerability has a low impact on Availability, it significantly poses a high risk to both Confidentiality and Integrity.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42993" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3580384" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-j52j-ph84-2j62/GHSA-j52j-ph84-2j62.json b/advisories/unreviewed/2025/06/GHSA-j52j-ph84-2j62/GHSA-j52j-ph84-2j62.json new file mode 100644 index 00000000000..7d04f95779b --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-j52j-ph84-2j62/GHSA-j52j-ph84-2j62.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j52j-ph84-2j62", + "modified": "2025-06-10T03:30:30Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2025-5908" + ], + "details": "A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This issue affects some unknown processing of the file /boafrm/formIpQoS of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5908" + }, + { + "type": "WEB", + "url": "https://github.com/byxs0x0/cve2/blob/main/4.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311681" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311681" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.592269" + }, + { + "type": "WEB", + "url": "https://www.totolink.net" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-jhc2-hv2x-fj67/GHSA-jhc2-hv2x-fj67.json b/advisories/unreviewed/2025/06/GHSA-jhc2-hv2x-fj67/GHSA-jhc2-hv2x-fj67.json new file mode 100644 index 00000000000..6d265de008f --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-jhc2-hv2x-fj67/GHSA-jhc2-hv2x-fj67.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jhc2-hv2x-fj67", + "modified": "2025-06-10T03:30:30Z", + "published": "2025-06-10T03:30:30Z", + "aliases": [ + "CVE-2025-5906" + ], + "details": "A vulnerability classified as critical has been found in code-projects Laundry System 1.0. This affects an unknown part of the file /data/. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5906" + }, + { + "type": "WEB", + "url": "https://github.com/tuooo/CVE/issues/11" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311679" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311679" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.592266" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-mf43-m2mh-xcq6/GHSA-mf43-m2mh-xcq6.json b/advisories/unreviewed/2025/06/GHSA-mf43-m2mh-xcq6/GHSA-mf43-m2mh-xcq6.json new file mode 100644 index 00000000000..cc3b13e3a7e --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-mf43-m2mh-xcq6/GHSA-mf43-m2mh-xcq6.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mf43-m2mh-xcq6", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:28Z", + "aliases": [ + "CVE-2025-31325" + ], + "details": "Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject malicious JavaScript into a web page through an unprotected parameter. When a victim accesses the affected page, the script executes in their browser, providing the attacker limited access to restricted information. The vulnerability does not affect data integrity or availability and operates entirely within the context of the client's browser.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31325" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3590887" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-p85x-xv8x-v67q/GHSA-p85x-xv8x-v67q.json b/advisories/unreviewed/2025/06/GHSA-p85x-xv8x-v67q/GHSA-p85x-xv8x-v67q.json new file mode 100644 index 00000000000..b7ac460f59d --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-p85x-xv8x-v67q/GHSA-p85x-xv8x-v67q.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p85x-xv8x-v67q", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2025-42989" + ], + "details": "RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker could critically impact both integrity and availability of the application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42989" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3600840" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-q44f-xpfq-69g2/GHSA-q44f-xpfq-69g2.json b/advisories/unreviewed/2025/06/GHSA-q44f-xpfq-69g2/GHSA-q44f-xpfq-69g2.json new file mode 100644 index 00000000000..3fb61f1aaf8 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-q44f-xpfq-69g2/GHSA-q44f-xpfq-69g2.json @@ -0,0 +1,25 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q44f-xpfq-69g2", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2024-55595" + ], + "details": "Rejected reason: Not used", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55595" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T03:15:38Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-q73c-hmcg-m3vx/GHSA-q73c-hmcg-m3vx.json b/advisories/unreviewed/2025/06/GHSA-q73c-hmcg-m3vx/GHSA-q73c-hmcg-m3vx.json new file mode 100644 index 00000000000..274aee3eb96 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-q73c-hmcg-m3vx/GHSA-q73c-hmcg-m3vx.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q73c-hmcg-m3vx", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2025-42996" + ], + "details": "SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticate giving the ability to access or modify non-sensitive information or consume sufficient resources which could degrade the performance of the server causing low impact on confidentiality, integrity and availibility of the application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42996" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3610006" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-590" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-qjqq-q9g6-p92r/GHSA-qjqq-q9g6-p92r.json b/advisories/unreviewed/2025/06/GHSA-qjqq-q9g6-p92r/GHSA-qjqq-q9g6-p92r.json new file mode 100644 index 00000000000..39e922ef2c3 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-qjqq-q9g6-p92r/GHSA-qjqq-q9g6-p92r.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qjqq-q9g6-p92r", + "modified": "2025-06-10T03:30:30Z", + "published": "2025-06-10T03:30:30Z", + "aliases": [ + "CVE-2025-5911" + ], + "details": "A vulnerability was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formDMZ of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5911" + }, + { + "type": "WEB", + "url": "https://github.com/byxs0x0/cve2/blob/main/7.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311684" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311684" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.592272" + }, + { + "type": "WEB", + "url": "https://www.totolink.net" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T03:15:39Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-qr2r-6pw3-h7m4/GHSA-qr2r-6pw3-h7m4.json b/advisories/unreviewed/2025/06/GHSA-qr2r-6pw3-h7m4/GHSA-qr2r-6pw3-h7m4.json new file mode 100644 index 00000000000..e479ba3bd33 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-qr2r-6pw3-h7m4/GHSA-qr2r-6pw3-h7m4.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qr2r-6pw3-h7m4", + "modified": "2025-06-10T03:30:29Z", + "published": "2025-06-10T03:30:29Z", + "aliases": [ + "CVE-2025-42984" + ], + "details": "SAP S/4HANA Manage Central Purchase Contract does not perform necessary authorization checks for an authenticated user. Due to this, an attacker could execute the function import on the entity making it inaccessible for unrestricted user. This has low impact on confidentiality and availability of the application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42984" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3441087" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-10T01:15:21Z" + } +} \ No newline at end of file