From 5ff95379bffa3c044256646da1a3eef4178cf1a8 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 2 Apr 2025 09:32:01 +0000
Subject: [PATCH] Publish Advisories

GHSA-8w6w-prh9-wr2j
GHSA-8w8h-m7f2-m6c4
GHSA-92fv-mr4v-6fw4
GHSA-cgm7-r9p7-vv73
GHSA-mpp3-j837-w9p4
GHSA-pphq-xpjc-vgqx
GHSA-xc8w-x6qp-w4p7
GHSA-xv86-gr62-vcj7
---
 .../GHSA-8w6w-prh9-wr2j.json                  | 36 +++++++++++++++++++
 .../GHSA-8w8h-m7f2-m6c4.json                  | 36 +++++++++++++++++++
 .../GHSA-92fv-mr4v-6fw4.json                  | 36 +++++++++++++++++++
 .../GHSA-cgm7-r9p7-vv73.json                  | 36 +++++++++++++++++++
 .../GHSA-mpp3-j837-w9p4.json                  | 36 +++++++++++++++++++
 .../GHSA-pphq-xpjc-vgqx.json                  | 36 +++++++++++++++++++
 .../GHSA-xc8w-x6qp-w4p7.json                  | 36 +++++++++++++++++++
 .../GHSA-xv86-gr62-vcj7.json                  | 36 +++++++++++++++++++
 8 files changed, 288 insertions(+)
 create mode 100644 advisories/unreviewed/2025/04/GHSA-8w6w-prh9-wr2j/GHSA-8w6w-prh9-wr2j.json
 create mode 100644 advisories/unreviewed/2025/04/GHSA-8w8h-m7f2-m6c4/GHSA-8w8h-m7f2-m6c4.json
 create mode 100644 advisories/unreviewed/2025/04/GHSA-92fv-mr4v-6fw4/GHSA-92fv-mr4v-6fw4.json
 create mode 100644 advisories/unreviewed/2025/04/GHSA-cgm7-r9p7-vv73/GHSA-cgm7-r9p7-vv73.json
 create mode 100644 advisories/unreviewed/2025/04/GHSA-mpp3-j837-w9p4/GHSA-mpp3-j837-w9p4.json
 create mode 100644 advisories/unreviewed/2025/04/GHSA-pphq-xpjc-vgqx/GHSA-pphq-xpjc-vgqx.json
 create mode 100644 advisories/unreviewed/2025/04/GHSA-xc8w-x6qp-w4p7/GHSA-xc8w-x6qp-w4p7.json
 create mode 100644 advisories/unreviewed/2025/04/GHSA-xv86-gr62-vcj7/GHSA-xv86-gr62-vcj7.json

diff --git a/advisories/unreviewed/2025/04/GHSA-8w6w-prh9-wr2j/GHSA-8w6w-prh9-wr2j.json b/advisories/unreviewed/2025/04/GHSA-8w6w-prh9-wr2j/GHSA-8w6w-prh9-wr2j.json
new file mode 100644
index 00000000000..f4ad1b4104a
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-8w6w-prh9-wr2j/GHSA-8w6w-prh9-wr2j.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8w6w-prh9-wr2j",
+  "modified": "2025-04-02T09:30:33Z",
+  "published": "2025-04-02T09:30:33Z",
+  "aliases": [
+    "CVE-2024-36469"
+  ],
+  "details": "Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36469"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.zabbix.com/browse/ZBX-26255"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-208"
+    ],
+    "severity": "LOW",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-02T07:15:40Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-8w8h-m7f2-m6c4/GHSA-8w8h-m7f2-m6c4.json b/advisories/unreviewed/2025/04/GHSA-8w8h-m7f2-m6c4/GHSA-8w8h-m7f2-m6c4.json
new file mode 100644
index 00000000000..e1ca38aa66e
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-8w8h-m7f2-m6c4/GHSA-8w8h-m7f2-m6c4.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8w8h-m7f2-m6c4",
+  "modified": "2025-04-02T09:30:33Z",
+  "published": "2025-04-02T09:30:32Z",
+  "aliases": [
+    "CVE-2024-45700"
+  ],
+  "details": "Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompression operations, ultimately leading to a service crash.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45700"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.zabbix.com/browse/ZBX-26253"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-770"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-02T07:15:41Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-92fv-mr4v-6fw4/GHSA-92fv-mr4v-6fw4.json b/advisories/unreviewed/2025/04/GHSA-92fv-mr4v-6fw4/GHSA-92fv-mr4v-6fw4.json
new file mode 100644
index 00000000000..c2bcb2d194f
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-92fv-mr4v-6fw4/GHSA-92fv-mr4v-6fw4.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-92fv-mr4v-6fw4",
+  "modified": "2025-04-02T09:30:33Z",
+  "published": "2025-04-02T09:30:33Z",
+  "aliases": [
+    "CVE-2024-39780"
+  ],
+  "details": "A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code. This issue has now been fixed for ROS Noetic via commit 3d93ac13603438323d7e9fa74e879e45c5fe2e8e.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39780"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ros/dynamic_reconfigure/pull/202"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-02T08:15:13Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-cgm7-r9p7-vv73/GHSA-cgm7-r9p7-vv73.json b/advisories/unreviewed/2025/04/GHSA-cgm7-r9p7-vv73/GHSA-cgm7-r9p7-vv73.json
new file mode 100644
index 00000000000..1f2a355a16a
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-cgm7-r9p7-vv73/GHSA-cgm7-r9p7-vv73.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cgm7-r9p7-vv73",
+  "modified": "2025-04-02T09:30:33Z",
+  "published": "2025-04-02T09:30:33Z",
+  "aliases": [
+    "CVE-2023-40714"
+  ],
+  "details": "A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40714"
+    },
+    {
+      "type": "WEB",
+      "url": "https://fortiguard.com/psirt/FG-IR-23-085"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-23"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-02T08:15:13Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-mpp3-j837-w9p4/GHSA-mpp3-j837-w9p4.json b/advisories/unreviewed/2025/04/GHSA-mpp3-j837-w9p4/GHSA-mpp3-j837-w9p4.json
new file mode 100644
index 00000000000..03b7eed4dc2
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-mpp3-j837-w9p4/GHSA-mpp3-j837-w9p4.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mpp3-j837-w9p4",
+  "modified": "2025-04-02T09:30:33Z",
+  "published": "2025-04-02T09:30:33Z",
+  "aliases": [
+    "CVE-2025-0415"
+  ],
+  "details": "A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or partial denial of connectivity for downstream systems that rely on its network services.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0415"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-259491-cve-2025-0415-command-injection-leading-to-denial-of-service-(dos)"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-78"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-02T07:15:41Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-pphq-xpjc-vgqx/GHSA-pphq-xpjc-vgqx.json b/advisories/unreviewed/2025/04/GHSA-pphq-xpjc-vgqx/GHSA-pphq-xpjc-vgqx.json
new file mode 100644
index 00000000000..4241328d032
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-pphq-xpjc-vgqx/GHSA-pphq-xpjc-vgqx.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pphq-xpjc-vgqx",
+  "modified": "2025-04-02T09:30:33Z",
+  "published": "2025-04-02T09:30:33Z",
+  "aliases": [
+    "CVE-2024-42325"
+  ],
+  "details": "Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42325"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.zabbix.com/browse/ZBX-26258"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-359"
+    ],
+    "severity": "LOW",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-02T07:15:41Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-xc8w-x6qp-w4p7/GHSA-xc8w-x6qp-w4p7.json b/advisories/unreviewed/2025/04/GHSA-xc8w-x6qp-w4p7/GHSA-xc8w-x6qp-w4p7.json
new file mode 100644
index 00000000000..f0137efe212
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-xc8w-x6qp-w4p7/GHSA-xc8w-x6qp-w4p7.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xc8w-x6qp-w4p7",
+  "modified": "2025-04-02T09:30:33Z",
+  "published": "2025-04-02T09:30:33Z",
+  "aliases": [
+    "CVE-2024-45699"
+  ],
+  "details": "The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45699"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.zabbix.com/browse/ZBX-26254"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-02T07:15:41Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-xv86-gr62-vcj7/GHSA-xv86-gr62-vcj7.json b/advisories/unreviewed/2025/04/GHSA-xv86-gr62-vcj7/GHSA-xv86-gr62-vcj7.json
new file mode 100644
index 00000000000..da492032489
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-xv86-gr62-vcj7/GHSA-xv86-gr62-vcj7.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xv86-gr62-vcj7",
+  "modified": "2025-04-02T09:30:33Z",
+  "published": "2025-04-02T09:30:33Z",
+  "aliases": [
+    "CVE-2025-0676"
+  ],
+  "details": "This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input validation to inject and execute systems commands. Successful exploitation could result in privilege escalation, allowing the attacker to gain root shell access and maintain persistent control over the device, potentially disrupting network services and affecting the availability of downstream systems that rely on its connectivity.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0676"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-259491-cve-2025-0676-command-injection-leading-to-privilege-escalation"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-78"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-02T07:15:41Z"
+  }
+}
\ No newline at end of file