netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2xm6-ff93-jr99
GHSA-49rr-34j5-r8mw
GHSA-925x-7pw7-xwpm
GHSA-cj8c-m8gc-8xmg
GHSA-hwq5-562f-8695
GHSA-pq7c-p5rc-hf55
This commit is contained in:
advisory-database[bot]
2025-06-02 00:31:42 +00:00
parent b8b970ff65
commit 4c7bd57e14
6 changed files with 344 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/06/GHSA-2xm6-ff93-jr99/GHSA-2xm6-ff93-jr99.json
+60
View File
@@ -0,0 +1,60 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2xm6-ff93-jr99",
"modified": "2025-06-02T00:30:27Z",
"published": "2025-06-02T00:30:27Z",
"aliases": [
"CVE-2025-5409"
],
"details": "A vulnerability was found in Mist Community Edition up to 4.7.1. It has been classified as critical. This affects the function create_token of the file src/mist/api/auth/views.py of the component API Token Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.2 is able to address this issue. The identifier of the patch is db10ecb62ac832c1ed4924556d167efb9bc07fad. It is recommended to upgrade the affected component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5409"
},
{
"type": "WEB",
"url": "https://github.com/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad"
},
{
"type": "WEB",
"url": "https://github.com/Stolichnayer/mist-ce-account-takeover"
},
{
"type": "WEB",
"url": "https://github.com/mistio/mist-ce/releases/tag/v4.7.2"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310749"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310749"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.583531"
}
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-01T22:15:21Z"
}
}
advisories/unreviewed/2025/06/GHSA-49rr-34j5-r8mw/GHSA-49rr-34j5-r8mw.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-49rr-34j5-r8mw",
"modified": "2025-06-02T00:30:28Z",
"published": "2025-06-02T00:30:28Z",
"aliases": [
"CVE-2025-5420"
],
"details": "A vulnerability classified as problematic was found in juzaweb CMS up to 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/file-manager/upload of the component Profile Page. The manipulation of the argument Upload leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5420"
},
{
"type": "WEB",
"url": "https://github.com/Cyber-Wo0dy/report/blob/main/juzawebcms/3.4.2/juzawebcms_avatar_xss.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310753"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310753"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.584048"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T00:15:20Z"
}
}
advisories/unreviewed/2025/06/GHSA-925x-7pw7-xwpm/GHSA-925x-7pw7-xwpm.json
+60
View File
@@ -0,0 +1,60 @@
{
"schema_version": "1.4.0",
"id": "GHSA-925x-7pw7-xwpm",
"modified": "2025-06-02T00:30:28Z",
"published": "2025-06-02T00:30:28Z",
"aliases": [
"CVE-2025-5412"
],
"details": "A vulnerability classified as problematic has been found in Mist Community Edition up to 4.7.1. Affected is the function Login of the file src/mist/api/views.py of the component Authentication Endpoint. The manipulation of the argument return_to leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.2 is able to address this issue. The name of the patch is db10ecb62ac832c1ed4924556d167efb9bc07fad. It is recommended to upgrade the affected component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5412"
},
{
"type": "WEB",
"url": "https://github.com/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad"
},
{
"type": "WEB",
"url": "https://github.com/Stolichnayer/mist-ce-open-redirect"
},
{
"type": "WEB",
"url": "https://github.com/mistio/mist-ce/releases/tag/v4.7.2"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310752"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310752"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.583534"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T00:15:20Z"
}
}
advisories/unreviewed/2025/06/GHSA-cj8c-m8gc-8xmg/GHSA-cj8c-m8gc-8xmg.json
+60
View File
@@ -0,0 +1,60 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cj8c-m8gc-8xmg",
"modified": "2025-06-02T00:30:28Z",
"published": "2025-06-02T00:30:28Z",
"aliases": [
"CVE-2025-5410"
],
"details": "A vulnerability was found in Mist Community Edition up to 4.7.1. It has been declared as problematic. This vulnerability affects the function session_start_response of the file src/mist/api/auth/middleware.py. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.2 is able to address this issue. The patch is identified as db10ecb62ac832c1ed4924556d167efb9bc07fad. It is recommended to upgrade the affected component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5410"
},
{
"type": "WEB",
"url": "https://github.com/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad"
},
{
"type": "WEB",
"url": "https://github.com/Stolichnayer/mist-ce-csrf"
},
{
"type": "WEB",
"url": "https://github.com/mistio/mist-ce/releases/tag/v4.7.2"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310750"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310750"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.583532"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-01T23:15:20Z"
}
}
advisories/unreviewed/2025/06/GHSA-hwq5-562f-8695/GHSA-hwq5-562f-8695.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hwq5-562f-8695",
"modified": "2025-06-02T00:30:27Z",
"published": "2025-06-02T00:30:27Z",
"aliases": [
"CVE-2025-5408"
],
"details": "A vulnerability was found in WAVLINK QUANTUM D2G, QUANTUM D3G, WL-WN530G3A, WL-WN530HG3, WL-WN532A3 and WL-WN576K1 up to V1410_240222 and classified as critical. Affected by this issue is the function sys_login of the file /cgi-bin/login.cgi of the component HTTP POST Request Handler. The manipulation of the argument login_page leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5408"
},
{
"type": "WEB",
"url": "https://github.com/CH13hh/tmp_store_cc/blob/main/wavlink/1.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310748"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310748"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.583486"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-01T22:15:20Z"
}
}
advisories/unreviewed/2025/06/GHSA-pq7c-p5rc-hf55/GHSA-pq7c-p5rc-hf55.json
+60
View File
@@ -0,0 +1,60 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pq7c-p5rc-hf55",
"modified": "2025-06-02T00:30:28Z",
"published": "2025-06-02T00:30:28Z",
"aliases": [
"CVE-2025-5411"
],
"details": "A vulnerability was found in Mist Community Edition up to 4.7.1. It has been rated as problematic. This issue affects the function tag_resources of the file src/mist/api/tag/views.py. The manipulation of the argument tag leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.7.2 is able to address this issue. The patch is named db10ecb62ac832c1ed4924556d167efb9bc07fad. It is recommended to upgrade the affected component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5411"
},
{
"type": "WEB",
"url": "https://github.com/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad"
},
{
"type": "WEB",
"url": "https://github.com/Stolichnayer/mist-ce-xss"
},
{
"type": "WEB",
"url": "https://github.com/mistio/mist-ce/releases/tag/v4.7.2"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310751"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310751"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.583533"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-01T23:15:20Z"
}
}