Publish Advisories

GHSA-2f4w-6mc7-4w78
GHSA-pm8j-3v64-92cq
GHSA-j3g3-5qv5-52mj

advisories/github-reviewed/2025/01/GHSA-2f4w-6mc7-4w78/GHSA-2f4w-6mc7-4w78.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2f4w-6mc7-4w78",
-  "modified": "2025-01-17T15:51:59Z",
+  "modified": "2025-04-28T18:32:57Z",
   "published": "2025-01-16T17:18:32Z",
   "aliases": [
     "CVE-2024-56144"
   ],
   "summary": "LibreNMS Display Name 2 Stored Cross-site Scripting vulnerability",
-  "details": "# StoredXSS-LibreNMS-Display Name 2\n\n\n**Description:**\n\n\nXSS on the parameters (Replace $DEVICE_ID with your specific $DEVICE_ID value):`/device/$DEVICE_ID/edit` -> param: display\n\n\nof Librenms versions 24.11.0 ([https://github.com/librenms/librenms](https://github.com/librenms/librenms)) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure.\n\n\n\n**Proof of Concept:**\n1. Add a new device through the LibreNMS interface.\n2. Edit the newly created device by going to the \"Device Settings\" section.\n3. In the \"Display Name\" field, enter the following payload: `\"><img src onerror=\"alert(document.cookie)\">`.\n![image](https://github.com/user-attachments/assets/b1664e15-eba8-4cdd-b730-fb18936f109c)\n4. Save the changes.\n5. The XSS payload is triggered when navigating to the path /device/$DEVICE_ID/logs and hovering over a type containing a tag (such as Core 1 in the image).\n![image](https://github.com/user-attachments/assets/df23cec8-94bb-4155-961b-52ea659654a2)\n\n\n\n**Impact:**\n\nExecution of Malicious Code\n\n",
+  "details": "# StoredXSS-LibreNMS-Display Name 2\n\n\n**Description:**\n\n\nXSS on the parameters (Replace $DEVICE_ID with your specific $DEVICE_ID value):`/device/$DEVICE_ID/edit` -> param: display\n\n\nof Librenms versions 24.11.0 ([https://github.com/librenms/librenms](https://github.com/librenms/librenms)) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure.\n\n\n\n**Proof of Concept:**\n1. Add a new device through the LibreNMS interface.\n2. Edit the newly created device by going to the \"Device Settings\" section.\n3. In the \"Display Name\" field, enter the following payload: `\"><img src onerror=\"alert(document.cookie)\">`.\n![image](https://github.com/user-attachments/assets/b1664e15-eba8-4cdd-b730-fb18936f109c)\n4. Save the changes.\n5. The XSS payload is triggered when navigating to the path /device/$DEVICE_ID/logs and hovering over a type containing a tag (such as Core 1 in the image).\n![image](https://github.com/user-attachments/assets/df23cec8-94bb-4155-961b-52ea659654a2)\n\n\n\n**Impact:**\n\nExecution of Malicious Code",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2025/04/GHSA-j3g3-5qv5-52mj/GHSA-j3g3-5qv5-52mj.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-j3g3-5qv5-52mj",
-  "modified": "2025-04-28T14:17:33Z",
+  "modified": "2025-04-28T18:33:17Z",
   "published": "2025-04-28T14:17:32Z",
   "aliases": [
     "CVE-2025-43857"
@@ -109,6 +109,10 @@
       "type": "WEB",
       "url": "https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43857"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/ruby/net-imap/pull/442"
@@ -144,6 +148,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2025-04-28T14:17:32Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2025-04-28T16:15:33Z"
   }
 }