From 5b868ba052ac3e476b6213b65aa0ff5816f435ba Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 28 Apr 2025 00:32:48 +0000 Subject: [PATCH] Publish Advisories GHSA-26f4-72gj-hchp GHSA-4jgj-9c7f-7hvv GHSA-53vj-jg5c-244w GHSA-59gw-jx9x-fx7m GHSA-93qv-v2xp-9mff GHSA-cpp9-4wg8-29gj GHSA-f9mq-j3wx-4h2h GHSA-g9hr-8mwc-g7m7 GHSA-h4xx-369g-v8j6 GHSA-jxcr-pjg6-v566 GHSA-vjcj-34mc-r9h4 --- .../GHSA-26f4-72gj-hchp.json | 48 ++++++++++++++++ .../GHSA-4jgj-9c7f-7hvv.json | 56 +++++++++++++++++++ .../GHSA-53vj-jg5c-244w.json | 56 +++++++++++++++++++ .../GHSA-59gw-jx9x-fx7m.json | 56 +++++++++++++++++++ .../GHSA-93qv-v2xp-9mff.json | 44 +++++++++++++++ .../GHSA-cpp9-4wg8-29gj.json | 56 +++++++++++++++++++ .../GHSA-f9mq-j3wx-4h2h.json | 56 +++++++++++++++++++ .../GHSA-g9hr-8mwc-g7m7.json | 48 ++++++++++++++++ .../GHSA-h4xx-369g-v8j6.json | 44 +++++++++++++++ .../GHSA-jxcr-pjg6-v566.json | 56 +++++++++++++++++++ .../GHSA-vjcj-34mc-r9h4.json | 48 ++++++++++++++++ 11 files changed, 568 insertions(+) create mode 100644 advisories/unreviewed/2025/04/GHSA-26f4-72gj-hchp/GHSA-26f4-72gj-hchp.json create mode 100644 advisories/unreviewed/2025/04/GHSA-4jgj-9c7f-7hvv/GHSA-4jgj-9c7f-7hvv.json create mode 100644 advisories/unreviewed/2025/04/GHSA-53vj-jg5c-244w/GHSA-53vj-jg5c-244w.json create mode 100644 advisories/unreviewed/2025/04/GHSA-59gw-jx9x-fx7m/GHSA-59gw-jx9x-fx7m.json create mode 100644 advisories/unreviewed/2025/04/GHSA-93qv-v2xp-9mff/GHSA-93qv-v2xp-9mff.json create mode 100644 advisories/unreviewed/2025/04/GHSA-cpp9-4wg8-29gj/GHSA-cpp9-4wg8-29gj.json create mode 100644 advisories/unreviewed/2025/04/GHSA-f9mq-j3wx-4h2h/GHSA-f9mq-j3wx-4h2h.json create mode 100644 advisories/unreviewed/2025/04/GHSA-g9hr-8mwc-g7m7/GHSA-g9hr-8mwc-g7m7.json create mode 100644 advisories/unreviewed/2025/04/GHSA-h4xx-369g-v8j6/GHSA-h4xx-369g-v8j6.json create mode 100644 advisories/unreviewed/2025/04/GHSA-jxcr-pjg6-v566/GHSA-jxcr-pjg6-v566.json create mode 100644 advisories/unreviewed/2025/04/GHSA-vjcj-34mc-r9h4/GHSA-vjcj-34mc-r9h4.json diff --git a/advisories/unreviewed/2025/04/GHSA-26f4-72gj-hchp/GHSA-26f4-72gj-hchp.json b/advisories/unreviewed/2025/04/GHSA-26f4-72gj-hchp/GHSA-26f4-72gj-hchp.json new file mode 100644 index 00000000000..fefc734e0d0 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-26f4-72gj-hchp/GHSA-26f4-72gj-hchp.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-26f4-72gj-hchp", + "modified": "2025-04-28T00:31:12Z", + "published": "2025-04-28T00:31:12Z", + "aliases": [ + "CVE-2025-31144" + ], + "details": "Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, a remote unauthenticated attacker may attempt to log in to an arbitrary host via Windows system where the product is running.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31144" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/jp/JVN82536398" + }, + { + "type": "WEB", + "url": "https://mfp-support.sios.jp/hc/ja/articles/45853460006937" + }, + { + "type": "WEB", + "url": "https://siosapps.sios.jp/agent_info/20250425001.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-923" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-28T00:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-4jgj-9c7f-7hvv/GHSA-4jgj-9c7f-7hvv.json b/advisories/unreviewed/2025/04/GHSA-4jgj-9c7f-7hvv/GHSA-4jgj-9c7f-7hvv.json new file mode 100644 index 00000000000..ab8ff1d2c32 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-4jgj-9c7f-7hvv/GHSA-4jgj-9c7f-7hvv.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4jgj-9c7f-7hvv", + "modified": "2025-04-28T00:31:11Z", + "published": "2025-04-28T00:31:11Z", + "aliases": [ + "CVE-2025-3989" + ], + "details": "A vulnerability classified as critical was found in TOTOLINK N150RT 3.4.0-B20190525. Affected by this vulnerability is an unknown functionality of the file /boafrm/formStaticDHCP. The manipulation of the argument Hostname leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3989" + }, + { + "type": "WEB", + "url": "https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_formStaticDHCP" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306325" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306325" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.557940" + }, + { + "type": "WEB", + "url": "https://www.totolink.net" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-27T23:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-53vj-jg5c-244w/GHSA-53vj-jg5c-244w.json b/advisories/unreviewed/2025/04/GHSA-53vj-jg5c-244w/GHSA-53vj-jg5c-244w.json new file mode 100644 index 00000000000..b3ba4c12933 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-53vj-jg5c-244w/GHSA-53vj-jg5c-244w.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-53vj-jg5c-244w", + "modified": "2025-04-28T00:31:12Z", + "published": "2025-04-28T00:31:12Z", + "aliases": [ + "CVE-2025-3991" + ], + "details": "A vulnerability, which was classified as critical, was found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the file /boafrm/formWdsEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3991" + }, + { + "type": "WEB", + "url": "https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_formWdsEncrypt" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306327" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306327" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.557942" + }, + { + "type": "WEB", + "url": "https://www.totolink.net" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-28T00:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-59gw-jx9x-fx7m/GHSA-59gw-jx9x-fx7m.json b/advisories/unreviewed/2025/04/GHSA-59gw-jx9x-fx7m/GHSA-59gw-jx9x-fx7m.json new file mode 100644 index 00000000000..4d45780f9fc --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-59gw-jx9x-fx7m/GHSA-59gw-jx9x-fx7m.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-59gw-jx9x-fx7m", + "modified": "2025-04-28T00:31:11Z", + "published": "2025-04-28T00:31:11Z", + "aliases": [ + "CVE-2025-3987" + ], + "details": "A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3987" + }, + { + "type": "WEB", + "url": "https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/RCE_formWsc" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306323" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306323" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.557938" + }, + { + "type": "WEB", + "url": "https://www.totolink.net" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-27T22:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-93qv-v2xp-9mff/GHSA-93qv-v2xp-9mff.json b/advisories/unreviewed/2025/04/GHSA-93qv-v2xp-9mff/GHSA-93qv-v2xp-9mff.json new file mode 100644 index 00000000000..c0329c6c1cb --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-93qv-v2xp-9mff/GHSA-93qv-v2xp-9mff.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-93qv-v2xp-9mff", + "modified": "2025-04-28T00:31:11Z", + "published": "2025-04-28T00:31:11Z", + "aliases": [ + "CVE-2025-46689" + ], + "details": "Ververica Platform 2.14.0 contain an Reflected XSS vulnerability via a namespaces/default/formats URI.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46689" + }, + { + "type": "WEB", + "url": "https://github.com/gozan10/cve/issues/17" + }, + { + "type": "WEB", + "url": "https://github.com/ververica/ververica-platform-playground" + }, + { + "type": "WEB", + "url": "https://www.ververica.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-27T22:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-cpp9-4wg8-29gj/GHSA-cpp9-4wg8-29gj.json b/advisories/unreviewed/2025/04/GHSA-cpp9-4wg8-29gj/GHSA-cpp9-4wg8-29gj.json new file mode 100644 index 00000000000..22486ebb9ad --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-cpp9-4wg8-29gj/GHSA-cpp9-4wg8-29gj.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cpp9-4wg8-29gj", + "modified": "2025-04-28T00:31:12Z", + "published": "2025-04-28T00:31:12Z", + "aliases": [ + "CVE-2025-3992" + ], + "details": "A vulnerability has been found in TOTOLINK N150RT 3.4.0-B20190525 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formWlwds. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3992" + }, + { + "type": "WEB", + "url": "https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_formWlwds" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306328" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306328" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.557943" + }, + { + "type": "WEB", + "url": "https://www.totolink.net" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-28T00:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-f9mq-j3wx-4h2h/GHSA-f9mq-j3wx-4h2h.json b/advisories/unreviewed/2025/04/GHSA-f9mq-j3wx-4h2h/GHSA-f9mq-j3wx-4h2h.json new file mode 100644 index 00000000000..3bad75dcfaa --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-f9mq-j3wx-4h2h/GHSA-f9mq-j3wx-4h2h.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f9mq-j3wx-4h2h", + "modified": "2025-04-28T00:31:11Z", + "published": "2025-04-28T00:31:11Z", + "aliases": [ + "CVE-2025-3988" + ], + "details": "A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525. Affected is an unknown function of the file /boafrm/formPortFw. The manipulation of the argument service_type leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3988" + }, + { + "type": "WEB", + "url": "https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_formPortFw" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306324" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306324" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.557939" + }, + { + "type": "WEB", + "url": "https://www.totolink.net" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-27T22:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-g9hr-8mwc-g7m7/GHSA-g9hr-8mwc-g7m7.json b/advisories/unreviewed/2025/04/GHSA-g9hr-8mwc-g7m7/GHSA-g9hr-8mwc-g7m7.json new file mode 100644 index 00000000000..20f4bf3143e --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-g9hr-8mwc-g7m7/GHSA-g9hr-8mwc-g7m7.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g9hr-8mwc-g7m7", + "modified": "2025-04-28T00:31:12Z", + "published": "2025-04-28T00:31:12Z", + "aliases": [ + "CVE-2025-27937" + ], + "details": "Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). If exploited, an arbitrary file in the affected product may be obtained by a remote attacker who can log in to the product.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27937" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/jp/JVN82536398" + }, + { + "type": "WEB", + "url": "https://mfp-support.sios.jp/hc/ja/articles/45853460006937" + }, + { + "type": "WEB", + "url": "https://siosapps.sios.jp/agent_info/20250425001.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-28T00:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-h4xx-369g-v8j6/GHSA-h4xx-369g-v8j6.json b/advisories/unreviewed/2025/04/GHSA-h4xx-369g-v8j6/GHSA-h4xx-369g-v8j6.json new file mode 100644 index 00000000000..63aeea92a87 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-h4xx-369g-v8j6/GHSA-h4xx-369g-v8j6.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h4xx-369g-v8j6", + "modified": "2025-04-28T00:31:11Z", + "published": "2025-04-28T00:31:11Z", + "aliases": [ + "CVE-2025-46690" + ], + "details": "Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats request.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46690" + }, + { + "type": "WEB", + "url": "https://github.com/gozan10/cve/issues/18" + }, + { + "type": "WEB", + "url": "https://github.com/ververica/ververica-platform-playground" + }, + { + "type": "WEB", + "url": "https://www.ververica.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-425" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-27T22:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-jxcr-pjg6-v566/GHSA-jxcr-pjg6-v566.json b/advisories/unreviewed/2025/04/GHSA-jxcr-pjg6-v566/GHSA-jxcr-pjg6-v566.json new file mode 100644 index 00000000000..5df1aac63f5 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-jxcr-pjg6-v566/GHSA-jxcr-pjg6-v566.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jxcr-pjg6-v566", + "modified": "2025-04-28T00:31:11Z", + "published": "2025-04-28T00:31:11Z", + "aliases": [ + "CVE-2025-3990" + ], + "details": "A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525. Affected by this issue is some unknown functionality of the file /boafrm/formVlan. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3990" + }, + { + "type": "WEB", + "url": "https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/BufferOverflow_formVlan" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306326" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306326" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.557941" + }, + { + "type": "WEB", + "url": "https://www.totolink.net" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-27T23:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-vjcj-34mc-r9h4/GHSA-vjcj-34mc-r9h4.json b/advisories/unreviewed/2025/04/GHSA-vjcj-34mc-r9h4/GHSA-vjcj-34mc-r9h4.json new file mode 100644 index 00000000000..8d2075f74bf --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-vjcj-34mc-r9h4/GHSA-vjcj-34mc-r9h4.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vjcj-34mc-r9h4", + "modified": "2025-04-28T00:31:12Z", + "published": "2025-04-28T00:31:11Z", + "aliases": [ + "CVE-2025-26692" + ], + "details": "Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). If exploited, arbitrary code may be executed by a remote unauthenticated attacker with the Windows system privilege where the product is running.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26692" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/jp/JVN82536398" + }, + { + "type": "WEB", + "url": "https://mfp-support.sios.jp/hc/ja/articles/45853460006937" + }, + { + "type": "WEB", + "url": "https://siosapps.sios.jp/agent_info/20250425001.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-28T00:15:15Z" + } +} \ No newline at end of file