netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-p8hv-f2qg-cxvv
GHSA-2j87-p623-8cc2
GHSA-382x-6jh5-7rh9
GHSA-3g9q-pxcf-xr75
GHSA-4j7f-c5p6-h9j2
GHSA-57hq-w56x-2gq6
GHSA-5qc3-c7fp-rxmg
GHSA-5rg9-mgvq-2fqh
GHSA-64vm-9x59-r8j6
GHSA-6vxr-44w3-hfhx
GHSA-733c-gpw4-q7pf
GHSA-7743-qf7f-3g5x
GHSA-9h6j-4ffx-cm84
GHSA-f9r4-6vx9-4gjx
GHSA-fwxj-c833-3v48
GHSA-gfc5-vx7h-qx8m
GHSA-h2g5-mxp5-qrcx
GHSA-h3ww-cm3r-pwhx
GHSA-w2w7-2p2r-c7xw
GHSA-wc2r-g885-938p
GHSA-x7pw-9qx9-8xw3
This commit is contained in:
advisory-database[bot]
2025-04-16 12:33:26 +00:00
parent 6582374d31
commit 535473d8f7
21 changed files with 922 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/12/GHSA-p8hv-f2qg-cxvv/GHSA-p8hv-f2qg-cxvv.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p8hv-f2qg-cxvv",
"modified": "2024-12-19T15:31:11Z",
"modified": "2025-04-16T12:31:17Z",
"published": "2024-12-19T15:31:11Z",
"aliases": [
"CVE-2024-9102"
@@ -19,6 +19,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9102"
},
{
"type": "WEB",
"url": "https://github.com/leenooks/phpLDAPadmin/issues/274#issuecomment-2586859072"
},
{
"type": "WEB",
"url": "https://github.com/leenooks/phpLDAPadmin/commit/ea17aadef46fd29850160987fe7740ceed1381ad#diff-93b9f3e6d4c5bdacf469ea0ec74c1e9217ca6272da9be5a1bfd711f7da16f9e3R240"
advisories/unreviewed/2025/04/GHSA-2j87-p623-8cc2/GHSA-2j87-p623-8cc2.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2j87-p623-8cc2",
"modified": "2025-04-16T12:31:19Z",
"published": "2025-04-16T12:31:19Z",
"aliases": [
"CVE-2025-27936"
],
"details": "Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27936"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-208"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T10:15:14Z"
}
}
advisories/unreviewed/2025/04/GHSA-382x-6jh5-7rh9/GHSA-382x-6jh5-7rh9.json
+37
View File
@@ -0,0 +1,37 @@
{
"schema_version": "1.4.0",
"id": "GHSA-382x-6jh5-7rh9",
"modified": "2025-04-16T12:31:19Z",
"published": "2025-04-16T12:31:19Z",
"aliases": [
"CVE-2024-58092"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix legacy client tracking initialization\n\nGet rid of the nfsd4_legacy_tracking_ops->init() call in\ncheck_for_legacy_methods(). That will be handled in the caller\n(nfsd4_client_tracking_init()). Otherwise, we'll wind up calling\nnfsd4_legacy_tracking_ops->init() twice, and the second time we'll\ntrigger the BUG_ON() in nfsd4_init_recdir().",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58092"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/95407304253a4bf03494d921c6913e220c26cc63"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cdd66082b227eb695cbf54b7c121ea032e869981"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/de71d4e211eddb670b285a0ea477a299601ce1ca"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T11:15:42Z"
}
}
advisories/unreviewed/2025/04/GHSA-3g9q-pxcf-xr75/GHSA-3g9q-pxcf-xr75.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3g9q-pxcf-xr75",
"modified": "2025-04-16T12:31:20Z",
"published": "2025-04-16T12:31:19Z",
"aliases": [
"CVE-2025-3681"
],
"details": "A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MODE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3681"
},
{
"type": "WEB",
"url": "https://fitoxs.com/exploit/exploit-f2dbb39791fbe7e94d805312769e84cb.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.304970"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.304970"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.552789"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T10:15:15Z"
}
}
advisories/unreviewed/2025/04/GHSA-4j7f-c5p6-h9j2/GHSA-4j7f-c5p6-h9j2.json
+41
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2025/04/GHSA-57hq-w56x-2gq6/GHSA-57hq-w56x-2gq6.json
+61
View File
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-57hq-w56x-2gq6",
"modified": "2025-04-16T12:31:20Z",
"published": "2025-04-16T12:31:20Z",
"aliases": [
"CVE-2025-22021"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\n\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\nrestore the original 5-tuple in case of SNAT, to be able to find the\nright socket (if any). Then socket_match() can correctly check whether\nthe socket was transparent.\n\nHowever, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this\nconntrack lookup, making xt_socket fail to match on the socket when the\npacket was SNATed. Add the same logic to nf_sk_lookup_slow_v6.\n\nIPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as\npods' addresses are in the fd00::/8 ULA subnet and need to be replaced\nwith the node's external address. Cilium leverages Envoy to enforce L7\npolicies, and Envoy uses transparent sockets. Cilium inserts an iptables\nprerouting rule that matches on `-m socket --transparent` and redirects\nthe packets to localhost, but it fails to match SNATed IPv6 packets due\nto that missing conntrack lookup.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22021"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1ca2169cc19dca893c7aae6af122852097435d16"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1ec43100f7123010730b7ddfc3d5c2eac19e70e7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/221c27259324ec1404f028d4f5a0f2ae7f63ee23"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2bb139e483f8cbe488d19d8c1135ac3615e2668c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/41904cbb343d115931d6bf79aa2c815cac4ef72b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5251041573850e5020cd447374e23010be698898"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/58ab63d3ded2ca6141357a2b24eee8453d0f871d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6488b96a79a26e19100ad872622f04e93b638d7f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/932b32ffd7604fb00b5c57e239a3cc4d901ccf6e"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T11:15:42Z"
}
}
advisories/unreviewed/2025/04/GHSA-5qc3-c7fp-rxmg/GHSA-5qc3-c7fp-rxmg.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5qc3-c7fp-rxmg",
"modified": "2025-04-16T12:31:20Z",
"published": "2025-04-16T12:31:20Z",
"aliases": [
"CVE-2025-3687"
],
"details": "A vulnerability, which was classified as problematic, has been found in misstt123 oasys 1.0. Affected by this issue is some unknown functionality of the component Sticky Notes Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3687"
},
{
"type": "WEB",
"url": "https://github.com/misstt123/oasys/issues/11"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.304976"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.304976"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.553429"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T12:15:17Z"
}
}
advisories/unreviewed/2025/04/GHSA-5rg9-mgvq-2fqh/GHSA-5rg9-mgvq-2fqh.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5rg9-mgvq-2fqh",
"modified": "2025-04-16T12:31:19Z",
"published": "2025-04-16T12:31:19Z",
"aliases": [
"CVE-2025-3679"
],
"details": "A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component HOST Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3679"
},
{
"type": "WEB",
"url": "https://fitoxs.com/exploit/exploit-42ef6503a06aafc10808fa38b9e2e8f7.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.304968"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.304968"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.552787"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T10:15:15Z"
}
}
advisories/unreviewed/2025/04/GHSA-64vm-9x59-r8j6/GHSA-64vm-9x59-r8j6.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-64vm-9x59-r8j6",
"modified": "2025-04-16T12:31:20Z",
"published": "2025-04-16T12:31:20Z",
"aliases": [
"CVE-2025-3686"
],
"details": "A vulnerability classified as problematic was found in misstt123 oasys 1.0. Affected by this vulnerability is the function image of the file /show. The manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3686"
},
{
"type": "WEB",
"url": "https://github.com/misstt123/oasys/issues/10"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.304975"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.304975"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.553372"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T12:15:17Z"
}
}
advisories/unreviewed/2025/04/GHSA-6vxr-44w3-hfhx/GHSA-6vxr-44w3-hfhx.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6vxr-44w3-hfhx",
"modified": "2025-04-16T12:31:20Z",
"published": "2025-04-16T12:31:20Z",
"aliases": [
"CVE-2025-3685"
],
"details": "A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Affected is an unknown function of the file /edit_fpatient.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3685"
},
{
"type": "WEB",
"url": "https://code-projects.org"
},
{
"type": "WEB",
"url": "https://github.com/bazhahei123/CVE/blob/main/sql_cve_4_8.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.304974"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.304974"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.553346"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T11:15:43Z"
}
}
advisories/unreviewed/2025/04/GHSA-733c-gpw4-q7pf/GHSA-733c-gpw4-q7pf.json
+41
View File
@@ -0,0 +1,41 @@
{
"schema_version": "1.4.0",
"id": "GHSA-733c-gpw4-q7pf",
"modified": "2025-04-16T12:31:19Z",
"published": "2025-04-16T12:31:19Z",
"aliases": [
"CVE-2025-22019"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcachefs: bch2_ioctl_subvolume_destroy() fixes\n\nbch2_evict_subvolume_inodes() was getting stuck - due to incorrectly\npruning the dcache.\n\nAlso, fix missing permissions checks.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22019"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/558317a5c61045d460a37372181e7b43c0c002bb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/707549600c4a012ed71c0204a7992a679880bf33"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/82383abd39abd635511b8956284a5cc8134c4dc1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9e6e83e1e2d01b99e70cd7812d7f758a8def9fc8"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T11:15:42Z"
}
}
advisories/unreviewed/2025/04/GHSA-7743-qf7f-3g5x/GHSA-7743-qf7f-3g5x.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7743-qf7f-3g5x",
"modified": "2025-04-16T12:31:20Z",
"published": "2025-04-16T12:31:19Z",
"aliases": [
"CVE-2025-3682"
],
"details": "A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component PASV Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3682"
},
{
"type": "WEB",
"url": "https://fitoxs.com/exploit/exploit-e3b0c44298fc1c149afbf4c8996fb924.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.304971"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.304971"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.552790"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T11:15:43Z"
}
}
advisories/unreviewed/2025/04/GHSA-9h6j-4ffx-cm84/GHSA-9h6j-4ffx-cm84.json
+34
View File
@@ -0,0 +1,34 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9h6j-4ffx-cm84",
"modified": "2025-04-16T12:31:19Z",
"published": "2025-04-16T12:31:19Z",
"aliases": [
"CVE-2025-31363"
],
"details": "Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31363"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T10:15:15Z"
}
}
advisories/unreviewed/2025/04/GHSA-f9r4-6vx9-4gjx/GHSA-f9r4-6vx9-4gjx.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f9r4-6vx9-4gjx",
"modified": "2025-04-16T12:31:20Z",
"published": "2025-04-16T12:31:20Z",
"aliases": [
"CVE-2025-3688"
],
"details": "A vulnerability, which was classified as problematic, was found in mirweiye Seven Bears Library CMS 2023. This affects an unknown part of the component Background Management Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3688"
},
{
"type": "WEB",
"url": "https://github.com/KKDT12138/CVE/blob/main/cve.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.304977"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.304977"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.553486"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T12:15:17Z"
}
}
advisories/unreviewed/2025/04/GHSA-fwxj-c833-3v48/GHSA-fwxj-c833-3v48.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fwxj-c833-3v48",
"modified": "2025-04-14T09:30:25Z",
"modified": "2025-04-16T12:31:18Z",
"published": "2025-04-14T09:30:24Z",
"aliases": [
"CVE-2025-3555"
@@ -23,6 +23,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3555"
},
{
"type": "WEB",
"url": "https://github.com/Maloyroyorko/E-commerce-3.0-user-bruter"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.304596"
advisories/unreviewed/2025/04/GHSA-gfc5-vx7h-qx8m/GHSA-gfc5-vx7h-qx8m.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gfc5-vx7h-qx8m",
"modified": "2025-04-16T12:31:20Z",
"published": "2025-04-16T12:31:20Z",
"aliases": [
"CVE-2025-3684"
],
"details": "A vulnerability was found in Xianqi Kindergarten Management System 2.0 Bulid 20190808. It has been rated as critical. This issue affects some unknown processing of the file stu_list.php of the component Child Management. The manipulation of the argument sex leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3684"
},
{
"type": "WEB",
"url": "https://github.com/Upgradeextension/xianqi/blob/main/README.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.304973"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.304973"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.553239"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T11:15:43Z"
}
}
advisories/unreviewed/2025/04/GHSA-h2g5-mxp5-qrcx/GHSA-h2g5-mxp5-qrcx.json
+61
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2025/04/GHSA-h3ww-cm3r-pwhx/GHSA-h3ww-cm3r-pwhx.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h3ww-cm3r-pwhx",
"modified": "2025-04-16T12:31:20Z",
"published": "2025-04-16T12:31:20Z",
"aliases": [
"CVE-2025-30960"
],
"details": "Missing Authorization vulnerability in NotFound FS Poster. This issue affects FS Poster: from n/a through 6.5.8.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30960"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/fs-poster/vulnerability/wordpress-fs-poster-plugin-6-5-8-subscriber-site-wide-broken-access-control-vulnerability?_s_id=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T11:15:43Z"
}
}
advisories/unreviewed/2025/04/GHSA-w2w7-2p2r-c7xw/GHSA-w2w7-2p2r-c7xw.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w2w7-2p2r-c7xw",
"modified": "2025-04-16T12:31:20Z",
"published": "2025-04-16T12:31:20Z",
"aliases": [
"CVE-2025-3683"
],
"details": "A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. This vulnerability affects unknown code of the component SIZE Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3683"
},
{
"type": "WEB",
"url": "https://fitoxs.com/exploit/exploit-5f4dcc3b5aa765d61d8327deb882cf99.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.304972"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.304972"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.552791"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T11:15:43Z"
}
}
advisories/unreviewed/2025/04/GHSA-wc2r-g885-938p/GHSA-wc2r-g885-938p.json
+41
View File
File diff suppressed because one or more lines are too long

Some files were not shown because too many files have changed in this diff Show More