diff --git a/advisories/github-reviewed/2025/01/GHSA-2f4w-6mc7-4w78/GHSA-2f4w-6mc7-4w78.json b/advisories/github-reviewed/2025/01/GHSA-2f4w-6mc7-4w78/GHSA-2f4w-6mc7-4w78.json
index f4b5b22670e..64de75a8bd5 100644
--- a/advisories/github-reviewed/2025/01/GHSA-2f4w-6mc7-4w78/GHSA-2f4w-6mc7-4w78.json
+++ b/advisories/github-reviewed/2025/01/GHSA-2f4w-6mc7-4w78/GHSA-2f4w-6mc7-4w78.json
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2f4w-6mc7-4w78",
- "modified": "2025-01-17T15:51:59Z",
+ "modified": "2025-04-28T18:32:57Z",
"published": "2025-01-16T17:18:32Z",
"aliases": [
"CVE-2024-56144"
],
"summary": "LibreNMS Display Name 2 Stored Cross-site Scripting vulnerability",
- "details": "# StoredXSS-LibreNMS-Display Name 2\n\n\n**Description:**\n\n\nXSS on the parameters (Replace $DEVICE_ID with your specific $DEVICE_ID value):`/device/$DEVICE_ID/edit` -> param: display\n\n\nof Librenms versions 24.11.0 ([https://github.com/librenms/librenms](https://github.com/librenms/librenms)) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure.\n\n\n\n**Proof of Concept:**\n1. Add a new device through the LibreNMS interface.\n2. Edit the newly created device by going to the \"Device Settings\" section.\n3. In the \"Display Name\" field, enter the following payload: `\">![]()
`.\n\n4. Save the changes.\n5. The XSS payload is triggered when navigating to the path /device/$DEVICE_ID/logs and hovering over a type containing a tag (such as Core 1 in the image).\n\n\n\n\n**Impact:**\n\nExecution of Malicious Code\n\n",
+ "details": "# StoredXSS-LibreNMS-Display Name 2\n\n\n**Description:**\n\n\nXSS on the parameters (Replace $DEVICE_ID with your specific $DEVICE_ID value):`/device/$DEVICE_ID/edit` -> param: display\n\n\nof Librenms versions 24.11.0 ([https://github.com/librenms/librenms](https://github.com/librenms/librenms)) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure.\n\n\n\n**Proof of Concept:**\n1. Add a new device through the LibreNMS interface.\n2. Edit the newly created device by going to the \"Device Settings\" section.\n3. In the \"Display Name\" field, enter the following payload: `\">![]()
`.\n\n4. Save the changes.\n5. The XSS payload is triggered when navigating to the path /device/$DEVICE_ID/logs and hovering over a type containing a tag (such as Core 1 in the image).\n\n\n\n\n**Impact:**\n\nExecution of Malicious Code",
"severity": [
{
"type": "CVSS_V3",
diff --git a/advisories/github-reviewed/2025/01/GHSA-pm8j-3v64-92cq/GHSA-pm8j-3v64-92cq.json b/advisories/github-reviewed/2025/01/GHSA-pm8j-3v64-92cq/GHSA-pm8j-3v64-92cq.json
index 6ee9e2aaad5..4d812a2b068 100644
--- a/advisories/github-reviewed/2025/01/GHSA-pm8j-3v64-92cq/GHSA-pm8j-3v64-92cq.json
+++ b/advisories/github-reviewed/2025/01/GHSA-pm8j-3v64-92cq/GHSA-pm8j-3v64-92cq.json
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pm8j-3v64-92cq",
- "modified": "2025-01-17T15:52:21Z",
+ "modified": "2025-04-28T18:33:03Z",
"published": "2025-01-16T17:21:20Z",
"aliases": [
"CVE-2025-23198"
],
"summary": "LibreNMS Display Name Stored Cross-site Scripting vulnerability",
- "details": "**Description:**\n\n\nXSS on the parameters (Replace $DEVICE_ID with your specific $DEVICE_ID value):`/device/$DEVICE_ID/edit` -> param: display\n\n\nof Librenms versions 24.9.0, 24.10.0, and 24.10.1 ([https://github.com/librenms/librenms](https://github.com/librenms/librenms)) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure.\n\n\n**Proof of Concept:**\n1. Add a new device through the LibreNMS interface.\n2. Edit the newly created device by going to the \"Device Settings\" section.\n3. In the \"Display Name\" field, enter the following payload: `\">`.\n\n\n4. Save the changes.\n5. The XSS payload triggers when accessing the \"/apps\" path (if an application was previously added).\n\n \n**Additional PoC:**\n1. In the \"Display Name\" field, enter the following payload: `\">![]()
`.\n\n\n2. The XSS vulnerability is triggered when accessing the \"/ports\" path, and the payload executes when hovering over the modified value in the \"Port\" field.\n\n- on `/device/$DEVICE_ID/ports/arp` path:\n\n\n- on `/device/$DEVICE_ID/logs` path:\n\n\n- on `/search/search=arp/` path:\n\n\n**Impact:**\n\nExecution of Malicious Code\n\n",
+ "details": "**Description:**\n\n\nXSS on the parameters (Replace $DEVICE_ID with your specific $DEVICE_ID value):`/device/$DEVICE_ID/edit` -> param: display\n\n\nof Librenms versions 24.9.0, 24.10.0, and 24.10.1 ([https://github.com/librenms/librenms](https://github.com/librenms/librenms)) allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure.\n\n\n**Proof of Concept:**\n1. Add a new device through the LibreNMS interface.\n2. Edit the newly created device by going to the \"Device Settings\" section.\n3. In the \"Display Name\" field, enter the following payload: `\">`.\n\n\n4. Save the changes.\n5. The XSS payload triggers when accessing the \"/apps\" path (if an application was previously added).\n\n \n**Additional PoC:**\n1. In the \"Display Name\" field, enter the following payload: `\">![]()
`.\n\n\n2. The XSS vulnerability is triggered when accessing the \"/ports\" path, and the payload executes when hovering over the modified value in the \"Port\" field.\n\n- on `/device/$DEVICE_ID/ports/arp` path:\n\n\n- on `/device/$DEVICE_ID/logs` path:\n\n\n- on `/search/search=arp/` path:\n\n\n**Impact:**\n\nExecution of Malicious Code",
"severity": [
{
"type": "CVSS_V3",
diff --git a/advisories/github-reviewed/2025/04/GHSA-j3g3-5qv5-52mj/GHSA-j3g3-5qv5-52mj.json b/advisories/github-reviewed/2025/04/GHSA-j3g3-5qv5-52mj/GHSA-j3g3-5qv5-52mj.json
index 3973e5c1bec..4dc9bda6ab4 100644
--- a/advisories/github-reviewed/2025/04/GHSA-j3g3-5qv5-52mj/GHSA-j3g3-5qv5-52mj.json
+++ b/advisories/github-reviewed/2025/04/GHSA-j3g3-5qv5-52mj/GHSA-j3g3-5qv5-52mj.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j3g3-5qv5-52mj",
- "modified": "2025-04-28T14:17:33Z",
+ "modified": "2025-04-28T18:33:17Z",
"published": "2025-04-28T14:17:32Z",
"aliases": [
"CVE-2025-43857"
@@ -109,6 +109,10 @@
"type": "WEB",
"url": "https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj"
},
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43857"
+ },
{
"type": "WEB",
"url": "https://github.com/ruby/net-imap/pull/442"
@@ -144,6 +148,6 @@
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-04-28T14:17:32Z",
- "nvd_published_at": null
+ "nvd_published_at": "2025-04-28T16:15:33Z"
}
}
\ No newline at end of file