Publish Advisories

GHSA-6wpq-rvpm-6542
GHSA-3wq7-w8r7-pmvh
GHSA-2wf3-32wx-c338
GHSA-3fhv-q33v-8j9m
GHSA-4qxv-j5h7-m4jq
GHSA-7975-2qr9-g542
GHSA-93c4-8fxm-4wq3
GHSA-95w3-8433-6jf6
GHSA-fm6v-wmjp-5rxq
GHSA-gpg3-74g9-p8jj
GHSA-j6c2-vwhh-r4vg
GHSA-p5p5-wgfg-gwq4
GHSA-ph42-w6gw-p84w
GHSA-pm49-6j2c-6857
GHSA-q57q-p5mg-4c5w
GHSA-rf94-f4r9-6gxh
GHSA-v6jm-7r7p-9979
GHSA-w4pw-p565-4p8w
GHSA-x9pj-5qm2-7p6v
This commit is contained in:
advisory-database[bot]
2025-01-10 00:32:00 +00:00
parent 1e7788ad62
commit 6a065f712c
19 changed files with 327 additions and 29 deletions
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
@@ -33,7 +33,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-125"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2wf3-32wx-c338",
"modified": "2025-01-09T21:31:31Z",
"modified": "2025-01-10T00:30:36Z",
"published": "2025-01-09T21:31:31Z",
"aliases": [
"CVE-2024-54761"
@@ -14,6 +14,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54761"
},
{
"type": "WEB",
"url": "https://gist.github.com/nscan9/a31982c90ab40a8e00373bf15efbf52a"
},
{
"type": "WEB",
"url": "https://github.com/nscan9/BigAnt-Office-Messenger-5.6.06-RCE-via-SQL-Injection"
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3fhv-q33v-8j9m",
"modified": "2025-01-10T00:30:36Z",
"published": "2025-01-10T00:30:36Z",
"aliases": [
"CVE-2025-21380"
],
"details": "Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21380"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21380"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T23:15:08Z"
}
}
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4qxv-j5h7-m4jq",
"modified": "2025-01-10T00:30:36Z",
"published": "2025-01-10T00:30:36Z",
"aliases": [
"CVE-2024-51229"
],
"details": "Cross Site Scripting vulnerability in LinZhaoguan pb-cms v.2.0 allows a remote attacker to execute arbitrary code via the theme management function.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51229"
},
{
"type": "WEB",
"url": "https://gitee.com/LinZhaoguan/pb-cms/issues/IAYHUP"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T22:15:29Z"
}
}
@@ -29,7 +29,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-22"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-93c4-8fxm-4wq3",
"modified": "2025-01-08T18:30:48Z",
"modified": "2025-01-10T00:30:35Z",
"published": "2025-01-08T18:30:48Z",
"aliases": [
"CVE-2024-56776"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sti: avoid potential dereference of error pointers\n\nThe return value of drm_atomic_get_crtc_state() needs to be\nchecked. To avoid use of error pointer 'crtc_state' in case\nof the failure.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -36,8 +41,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-754"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-08T18:15:18Z"
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-95w3-8433-6jf6",
"modified": "2025-01-08T18:30:49Z",
"modified": "2025-01-10T00:30:36Z",
"published": "2025-01-08T18:30:49Z",
"aliases": [
"CVE-2024-56780"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nquota: flush quota_release_work upon quota writeback\n\nOne of the paths quota writeback is called from is:\n\nfreeze_super()\n sync_filesystem()\n ext4_sync_fs()\n dquot_writeback_dquots()\n\nSince we currently don't always flush the quota_release_work queue in\nthis path, we can end up with the following race:\n\n 1. dquot are added to releasing_dquots list during regular operations.\n 2. FS Freeze starts, however, this does not flush the quota_release_work queue.\n 3. Freeze completes.\n 4. Kernel eventually tries to flush the workqueue while FS is frozen which\n hits a WARN_ON since transaction gets started during frozen state:\n\n ext4_journal_check_start+0x28/0x110 [ext4] (unreliable)\n __ext4_journal_start_sb+0x64/0x1c0 [ext4]\n ext4_release_dquot+0x90/0x1d0 [ext4]\n quota_release_workfn+0x43c/0x4d0\n\nWhich is the following line:\n\n WARN_ON(sb->s_writers.frozen == SB_FREEZE_COMPLETE);\n\nWhich ultimately results in generic/390 failing due to dmesg\nnoise. This was detected on powerpc machine 15 cores.\n\nTo avoid this, make sure to flush the workqueue during\ndquot_writeback_dquots() so we dont have any pending workitems after\nfreeze.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -45,7 +50,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-08T18:15:18Z"
@@ -41,7 +41,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-77"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gpg3-74g9-p8jj",
"modified": "2025-01-10T00:30:36Z",
"published": "2025-01-10T00:30:36Z",
"aliases": [
"CVE-2024-46464"
],
"details": "In PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user access can be manipulated to render the host computer unavailable or to execute programs with an elevation of privilege.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46464"
},
{
"type": "WEB",
"url": "https://www.primx.eu/en/bulletins/security-bulletin-24931935"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T22:15:28Z"
}
}
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j6c2-vwhh-r4vg",
"modified": "2025-01-10T00:30:36Z",
"published": "2025-01-10T00:30:36Z",
"aliases": [
"CVE-2024-56377"
],
"details": "A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the Survey Title field or Survey Instructions. When a user receives a survey and clicks anywhere on the survey page to enter data, the crafted payload (which has been injected into all survey fields) is executed, potentially enabling the execution of arbitrary web scripts.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56377"
},
{
"type": "WEB",
"url": "https://github.com/ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE-2024-56377/README.md"
},
{
"type": "WEB",
"url": "https://www.evms.edu/research/resources_services/redcap/redcap_change_log"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T23:15:08Z"
}
}
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p5p5-wgfg-gwq4",
"modified": "2025-01-10T00:30:36Z",
"published": "2025-01-10T00:30:36Z",
"aliases": [
"CVE-2024-56376"
],
"details": "A stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the message field. When a user click on the received message, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56376"
},
{
"type": "WEB",
"url": "https://github.com/ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE-2024-56376/README.md"
},
{
"type": "WEB",
"url": "https://www.evms.edu/research/resources_services/redcap/redcap_change_log"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T23:15:07Z"
}
}
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-ph42-w6gw-p84w",
"modified": "2025-01-10T00:30:36Z",
"published": "2025-01-10T00:30:36Z",
"aliases": [
"CVE-2023-28354"
],
"details": "An issue was discovered in Opsview Monitor Agent 6.8. An unauthenticated remote attacker can call check_nrpe against affected targets, specifying known NRPE plugins, which in default installations are configured to accept command control characters and pass them to command-line interpreters for NRPE plugin execution. This allows the attacker to escape NRPE plugin execution and execute commands remotely on the target as NT_AUTHORITY\\SYSTEM.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28354"
},
{
"type": "WEB",
"url": "https://github.com/stormfleet/CVE-2023-28354/blob/main/README.md"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T22:15:26Z"
}
}
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pm49-6j2c-6857",
"modified": "2025-01-08T18:30:48Z",
"modified": "2025-01-10T00:30:35Z",
"published": "2025-01-08T18:30:48Z",
"aliases": [
"CVE-2024-56775"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix handling of plane refcount\n\n[Why]\nThe mechanism to backup and restore plane states doesn't maintain\nrefcount, which can cause issues if the refcount of the plane changes\nin between backup and restore operations, such as memory leaks if the\nrefcount was supposed to go down, or double frees / invalid memory\naccesses if the refcount was supposed to go up.\n\n[How]\nCache and re-apply current refcount when restoring plane states.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-401"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-08T18:15:18Z"
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q57q-p5mg-4c5w",
"modified": "2025-01-10T00:30:36Z",
"published": "2025-01-10T00:30:36Z",
"aliases": [
"CVE-2025-21385"
],
"details": "A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21385"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21385"
}
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T22:15:29Z"
}
}
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rf94-f4r9-6gxh",
"modified": "2025-01-09T00:31:34Z",
"modified": "2025-01-10T00:30:36Z",
"published": "2025-01-09T00:31:34Z",
"aliases": [
"CVE-2025-0282"
@@ -19,9 +19,17 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0282"
},
{
"type": "WEB",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"
},
{
"type": "WEB",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282"
}
],
"database_specific": {
File diff suppressed because one or more lines are too long
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w4pw-p565-4p8w",
"modified": "2025-01-08T18:30:48Z",
"modified": "2025-01-10T00:30:35Z",
"published": "2025-01-08T18:30:48Z",
"aliases": [
"CVE-2024-56777"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check\n\nThe return value of drm_atomic_get_crtc_state() needs to be\nchecked. To avoid use of error pointer 'crtc_state' in case\nof the failure.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -36,8 +41,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-754"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-08T18:15:18Z"
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x9pj-5qm2-7p6v",
"modified": "2025-01-08T18:30:49Z",
"modified": "2025-01-10T00:30:36Z",
"published": "2025-01-08T18:30:49Z",
"aliases": [
"CVE-2024-56778"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check\n\nThe return value of drm_atomic_get_crtc_state() needs to be\nchecked. To avoid use of error pointer 'crtc_state' in case\nof the failure.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -36,8 +41,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-754"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-08T18:15:18Z"