netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2025-02-12 15:34:03 +00:00
parent 05462710b8
commit 58e50343ec
89 changed files with 2621 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/03/GHSA-cqq6-v7j5-vr3p/GHSA-cqq6-v7j5-vr3p.json
+2 -1
View File
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-287"
"CWE-287",
"CWE-305"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/02/GHSA-4rwx-mrf5-wx33/GHSA-4rwx-mrf5-wx33.json
+3 -1
View File
@@ -33,7 +33,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2024/02/GHSA-f27j-4f6g-jp27/GHSA-f27j-4f6g-jp27.json
+3 -1
View File
@@ -33,7 +33,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2024/04/GHSA-r92g-h2wj-6rv5/GHSA-r92g-h2wj-6rv5.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r92g-h2wj-6rv5",
"modified": "2024-04-29T00:30:42Z",
"modified": "2025-02-12T15:31:53Z",
"published": "2024-04-29T00:30:42Z",
"aliases": [
"CVE-2024-33891"
@@ -27,6 +27,10 @@
"type": "WEB",
"url": "https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000001.htm"
},
{
"type": "WEB",
"url": "https://github.com/straightblast/My-PoC-Exploits/blob/master/CVE-2024-33891.py"
},
{
"type": "WEB",
"url": "https://straightblast.medium.com/all-your-secrets-are-belong-to-us-a-delinea-secret-server-authn-authz-bypass-adc26c800ad3"
advisories/unreviewed/2025/02/GHSA-29vj-gvmm-9fp3/GHSA-29vj-gvmm-9fp3.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-29vj-gvmm-9fp3",
"modified": "2025-02-12T15:31:59Z",
"published": "2025-02-12T15:31:59Z",
"aliases": [
"CVE-2024-23563"
],
"details": "HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23563"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0119097"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:30Z"
}
}
advisories/unreviewed/2025/02/GHSA-2ghh-xmvf-53hw/GHSA-2ghh-xmvf-53hw.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-787"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2025/02/GHSA-2rr6-jrx8-xrg7/GHSA-2rr6-jrx8-xrg7.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2rr6-jrx8-xrg7",
"modified": "2025-02-12T15:32:01Z",
"published": "2025-02-12T15:32:01Z",
"aliases": [
"CVE-2025-26358"
],
"details": "A CWE-20 \"Improper Input Validation\" in ldbMT.so in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to modify system configuration via crafted HTTP requests.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26358"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26358"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:36Z"
}
}
advisories/unreviewed/2025/02/GHSA-2vrc-ghfq-ww6x/GHSA-2vrc-ghfq-ww6x.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-787"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2025/02/GHSA-2x8g-3gf7-5cw3/GHSA-2x8g-3gf7-5cw3.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2x8g-3gf7-5cw3",
"modified": "2025-02-12T15:32:01Z",
"published": "2025-02-12T15:32:01Z",
"aliases": [
"CVE-2025-26365"
],
"details": "A CWE-306 \"Missing Authentication for Critical Function\" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable front panel authentication via crafted HTTP requests.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26365"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26365"
}
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:37Z"
}
}
advisories/unreviewed/2025/02/GHSA-34m4-9vvp-p7j9/GHSA-34m4-9vvp-p7j9.json
+2 -1
View File
@@ -42,7 +42,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-74"
"CWE-74",
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2025/02/GHSA-357m-wr6w-wcjg/GHSA-357m-wr6w-wcjg.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-357m-wr6w-wcjg",
"modified": "2025-02-12T15:32:01Z",
"published": "2025-02-12T15:32:01Z",
"aliases": [
"CVE-2025-26357"
],
"details": "A CWE-35 \"Path Traversal\" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26357"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26357"
}
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:36Z"
}
}
advisories/unreviewed/2025/02/GHSA-384q-wx27-r5cm/GHSA-384q-wx27-r5cm.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-787"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2025/02/GHSA-3vf5-967m-jfcw/GHSA-3vf5-967m-jfcw.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3vf5-967m-jfcw",
"modified": "2025-02-12T15:32:01Z",
"published": "2025-02-12T15:32:01Z",
"aliases": [
"CVE-2025-26361"
],
"details": "A CWE-306 \"Missing Authentication for Critical Function\" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to factory reset the device via crafted HTTP requests.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26361"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26361"
}
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:36Z"
}
}
advisories/unreviewed/2025/02/GHSA-4gwx-j98p-3g7q/GHSA-4gwx-j98p-3g7q.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4gwx-j98p-3g7q",
"modified": "2025-02-12T15:32:01Z",
"published": "2025-02-12T15:32:01Z",
"aliases": [
"CVE-2025-26370"
],
"details": "A CWE-862 \"Missing Authorization\" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove privileges from user groups via crafted HTTP requests.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26370"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26370"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:37Z"
}
}
advisories/unreviewed/2025/02/GHSA-4xg2-vjm8-8r9m/GHSA-4xg2-vjm8-8r9m.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4xg2-vjm8-8r9m",
"modified": "2025-02-12T15:32:00Z",
"published": "2025-02-12T15:32:00Z",
"aliases": [
"CVE-2025-26343"
],
"details": "A CWE-1390 \"Weak Authentication\" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to brute-force user PINs via multiple crafted HTTP requests.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26343"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26343"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1390"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:34Z"
}
}
advisories/unreviewed/2025/02/GHSA-5c3r-jc6c-jrpr/GHSA-5c3r-jc6c-jrpr.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5c3r-jc6c-jrpr",
"modified": "2025-02-12T15:32:00Z",
"published": "2025-02-12T15:32:00Z",
"aliases": [
"CVE-2025-26342"
],
"details": "A CWE-306 \"Missing Authentication for Critical Function\" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to create arbitrary users, including administrators, via crafted HTTP requests.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26342"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26342"
}
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:33Z"
}
}
advisories/unreviewed/2025/02/GHSA-5j5f-9wh9-hfj9/GHSA-5j5f-9wh9-hfj9.json
+53
View File
@@ -0,0 +1,53 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5j5f-9wh9-hfj9",
"modified": "2025-02-12T15:31:59Z",
"published": "2025-02-12T15:31:59Z",
"aliases": [
"CVE-2024-57951"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhrtimers: Handle CPU state correctly on hotplug\n\nConsider a scenario where a CPU transitions from CPUHP_ONLINE to halfway\nthrough a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to\nCPUHP_ONLINE:\n\nSince hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set\nto 1 throughout. However, during a CPU unplug operation, the tick and the\nclockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online\nstate, for instance CFS incorrectly assumes that the hrtick is already\nactive, and the chance of the clockevent device to transition to oneshot\nmode is also lost forever for the CPU, unless it goes back to a lower state\nthan CPUHP_HRTIMERS_PREPARE once.\n\nThis round-trip reveals another issue; cpu_base.online is not set to 1\nafter the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer().\n\nAside of that, the bulk of the per CPU state is not reset either, which\nmeans there are dangling pointers in the worst case.\n\nAddress this by adding a corresponding startup() callback, which resets the\nstale per CPU state and sets the online flag.\n\n[ tglx: Make the new callback unconditionally available, remove the online\n \tmodification in the prepare() callback and clear the remaining\n \tstate in the starting callback instead of the prepare callback ]",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57951"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/14984139f1f2768883332965db566ef26db609e7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/15b453db41d36184cf0ccc21e7df624014ab6a1a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2f8dea1692eef2b7ba6a256246ed82c365fdc686"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/38492f6ee883c7b1d33338bf531a62cff69b4b28"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3d41dbf82e10c44e53ea602398ab002baec27e75"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/95e4f62df23f4df1ce6ef897d44b8e23c260921a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a5cbbea145b400e40540c34816d16d36e0374fbc"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:31Z"
}
}
advisories/unreviewed/2025/02/GHSA-5wmc-7h58-9rmm/GHSA-5wmc-7h58-9rmm.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-125"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2025/02/GHSA-5xh3-j434-h57h/GHSA-5xh3-j434-h57h.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5xh3-j434-h57h",
"modified": "2025-02-12T15:32:00Z",
"published": "2025-02-12T15:32:00Z",
"aliases": [
"CVE-2025-26348"
],
"details": "A CWE-89 \"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\" in maxprofile/menu/model.lua (editUserMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requests.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26348"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26348"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:34Z"
}
}
advisories/unreviewed/2025/02/GHSA-62j6-3mx6-32xv/GHSA-62j6-3mx6-32xv.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-62j6-3mx6-32xv",
"modified": "2025-02-12T15:32:01Z",
"published": "2025-02-12T15:32:01Z",
"aliases": [
"CVE-2025-26355"
],
"details": "A CWE-35 \"Path Traversal\" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26355"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26355"
}
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:35Z"
}
}

Some files were not shown because too many files have changed in this diff Show More