diff --git a/advisories/unreviewed/2023/06/GHSA-4x64-w698-xf5g/GHSA-4x64-w698-xf5g.json b/advisories/unreviewed/2023/06/GHSA-4x64-w698-xf5g/GHSA-4x64-w698-xf5g.json index a279e013707..5eaf34324fd 100644 --- a/advisories/unreviewed/2023/06/GHSA-4x64-w698-xf5g/GHSA-4x64-w698-xf5g.json +++ b/advisories/unreviewed/2023/06/GHSA-4x64-w698-xf5g/GHSA-4x64-w698-xf5g.json @@ -38,7 +38,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-704" + "CWE-704", + "CWE-843" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-573m-fgh4-jc94/GHSA-573m-fgh4-jc94.json b/advisories/unreviewed/2023/06/GHSA-573m-fgh4-jc94/GHSA-573m-fgh4-jc94.json index 388ea97d4fc..0e7effc9203 100644 --- a/advisories/unreviewed/2023/06/GHSA-573m-fgh4-jc94/GHSA-573m-fgh4-jc94.json +++ b/advisories/unreviewed/2023/06/GHSA-573m-fgh4-jc94/GHSA-573m-fgh4-jc94.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-1021" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2023/06/GHSA-rm3j-9j4x-mr94/GHSA-rm3j-9j4x-mr94.json b/advisories/unreviewed/2023/06/GHSA-rm3j-9j4x-mr94/GHSA-rm3j-9j4x-mr94.json index c6eb5bfdb1d..42471c7baef 100644 --- a/advisories/unreviewed/2023/06/GHSA-rm3j-9j4x-mr94/GHSA-rm3j-9j4x-mr94.json +++ b/advisories/unreviewed/2023/06/GHSA-rm3j-9j4x-mr94/GHSA-rm3j-9j4x-mr94.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-425" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2023/06/GHSA-xwh8-4fp4-mvqf/GHSA-xwh8-4fp4-mvqf.json b/advisories/unreviewed/2023/06/GHSA-xwh8-4fp4-mvqf/GHSA-xwh8-4fp4-mvqf.json index 8f71e77afa4..dce72827591 100644 --- a/advisories/unreviewed/2023/06/GHSA-xwh8-4fp4-mvqf/GHSA-xwh8-4fp4-mvqf.json +++ b/advisories/unreviewed/2023/06/GHSA-xwh8-4fp4-mvqf/GHSA-xwh8-4fp4-mvqf.json @@ -37,7 +37,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-22" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/02/GHSA-ffm2-8jrv-hhxj/GHSA-ffm2-8jrv-hhxj.json b/advisories/unreviewed/2024/02/GHSA-ffm2-8jrv-hhxj/GHSA-ffm2-8jrv-hhxj.json index da7dab2009c..2ac0c32a9da 100644 --- a/advisories/unreviewed/2024/02/GHSA-ffm2-8jrv-hhxj/GHSA-ffm2-8jrv-hhxj.json +++ b/advisories/unreviewed/2024/02/GHSA-ffm2-8jrv-hhxj/GHSA-ffm2-8jrv-hhxj.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-ffm2-8jrv-hhxj", - "modified": "2024-02-28T09:30:38Z", + "modified": "2025-01-09T18:32:06Z", "published": "2024-02-28T09:30:38Z", "aliases": [ "CVE-2021-47039" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nataflop: potential out of bounds in do_format()\n\nThe function uses \"type\" as an array index:\n\n\tq = unit[drive].disk[type]->queue;\n\nUnfortunately the bounds check on \"type\" isn't done until later in the\nfunction. Fix this by moving the bounds check to the start.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -28,8 +33,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T09:15:39Z" diff --git a/advisories/unreviewed/2024/03/GHSA-2c78-596m-9g6p/GHSA-2c78-596m-9g6p.json b/advisories/unreviewed/2024/03/GHSA-2c78-596m-9g6p/GHSA-2c78-596m-9g6p.json index c17fb2d0d85..014291cabfb 100644 --- a/advisories/unreviewed/2024/03/GHSA-2c78-596m-9g6p/GHSA-2c78-596m-9g6p.json +++ b/advisories/unreviewed/2024/03/GHSA-2c78-596m-9g6p/GHSA-2c78-596m-9g6p.json @@ -26,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-59", "CWE-61" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2024/03/GHSA-47fv-c4cg-c767/GHSA-47fv-c4cg-c767.json b/advisories/unreviewed/2024/03/GHSA-47fv-c4cg-c767/GHSA-47fv-c4cg-c767.json index 47cdb43cb00..05b633dbcc8 100644 --- a/advisories/unreviewed/2024/03/GHSA-47fv-c4cg-c767/GHSA-47fv-c4cg-c767.json +++ b/advisories/unreviewed/2024/03/GHSA-47fv-c4cg-c767/GHSA-47fv-c4cg-c767.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-47fv-c4cg-c767", - "modified": "2024-03-02T00:31:30Z", + "modified": "2025-01-09T18:32:06Z", "published": "2024-03-02T00:31:30Z", "aliases": [ "CVE-2021-47069" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry\n\ndo_mq_timedreceive calls wq_sleep with a stack local address. The\nsender (do_mq_timedsend) uses this address to later call pipelined_send.\n\nThis leads to a very hard to trigger race where a do_mq_timedreceive\ncall might return and leave do_mq_timedsend to rely on an invalid\naddress, causing the following crash:\n\n RIP: 0010:wake_q_add_safe+0x13/0x60\n Call Trace:\n __x64_sys_mq_timedsend+0x2a9/0x490\n do_syscall_64+0x80/0x680\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n RIP: 0033:0x7f5928e40343\n\nThe race occurs as:\n\n1. do_mq_timedreceive calls wq_sleep with the address of `struct\n ext_wait_queue` on function stack (aliased as `ewq_addr` here) - it\n holds a valid `struct ext_wait_queue *` as long as the stack has not\n been overwritten.\n\n2. `ewq_addr` gets added to info->e_wait_q[RECV].list in wq_add, and\n do_mq_timedsend receives it via wq_get_first_waiter(info, RECV) to call\n __pipelined_op.\n\n3. Sender calls __pipelined_op::smp_store_release(&this->state,\n STATE_READY). Here is where the race window begins. (`this` is\n `ewq_addr`.)\n\n4. If the receiver wakes up now in do_mq_timedreceive::wq_sleep, it\n will see `state == STATE_READY` and break.\n\n5. do_mq_timedreceive returns, and `ewq_addr` is no longer guaranteed\n to be a `struct ext_wait_queue *` since it was on do_mq_timedreceive's\n stack. (Although the address may not get overwritten until another\n function happens to touch it, which means it can persist around for an\n indefinite time.)\n\n6. do_mq_timedsend::__pipelined_op() still believes `ewq_addr` is a\n `struct ext_wait_queue *`, and uses it to find a task_struct to pass to\n the wake_q_add_safe call. In the lucky case where nothing has\n overwritten `ewq_addr` yet, `ewq_addr->task` is the right task_struct.\n In the unlucky case, __pipelined_op::wake_q_add_safe gets handed a\n bogus address as the receiver's task_struct causing the crash.\n\ndo_mq_timedsend::__pipelined_op() should not dereference `this` after\nsetting STATE_READY, as the receiver counterpart is now free to return.\nChange __pipelined_op to call wake_q_add_safe on the receiver's\ntask_struct returned by get_task_struct, instead of dereferencing `this`\nwhich sits on the receiver's stack.\n\nAs Manfred pointed out, the race potentially also exists in\nipc/msg.c::expunge_all and ipc/sem.c::wake_up_sem_queue_prepare. Fix\nthose in the same way.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -28,8 +33,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-672" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-01T22:15:46Z" diff --git a/advisories/unreviewed/2024/03/GHSA-r2p4-xrgf-rxrx/GHSA-r2p4-xrgf-rxrx.json b/advisories/unreviewed/2024/03/GHSA-r2p4-xrgf-rxrx/GHSA-r2p4-xrgf-rxrx.json index 8a84d7244c3..27118aab0a6 100644 --- a/advisories/unreviewed/2024/03/GHSA-r2p4-xrgf-rxrx/GHSA-r2p4-xrgf-rxrx.json +++ b/advisories/unreviewed/2024/03/GHSA-r2p4-xrgf-rxrx/GHSA-r2p4-xrgf-rxrx.json @@ -26,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-59", "CWE-61" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2024/03/GHSA-x2mc-jwgp-h2fq/GHSA-x2mc-jwgp-h2fq.json b/advisories/unreviewed/2024/03/GHSA-x2mc-jwgp-h2fq/GHSA-x2mc-jwgp-h2fq.json index c33694da7bc..3c1d5d1209d 100644 --- a/advisories/unreviewed/2024/03/GHSA-x2mc-jwgp-h2fq/GHSA-x2mc-jwgp-h2fq.json +++ b/advisories/unreviewed/2024/03/GHSA-x2mc-jwgp-h2fq/GHSA-x2mc-jwgp-h2fq.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-x2mc-jwgp-h2fq", - "modified": "2024-03-01T00:30:28Z", + "modified": "2025-01-09T18:32:06Z", "published": "2024-03-01T00:30:28Z", "aliases": [ "CVE-2021-47055" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: require write permissions for locking and badblock ioctls\n\nMEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require\nwrite permission. Depending on the hardware MEMLOCK might even be\nwrite-once, e.g. for SPI-NOR flashes with their WP# tied to GND. OTPLOCK\nis always write-once.\n\nMEMSETBADBLOCK modifies the bad block table.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -52,8 +57,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-667" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-29T23:15:07Z" diff --git a/advisories/unreviewed/2024/04/GHSA-44j5-2jvm-f6f7/GHSA-44j5-2jvm-f6f7.json b/advisories/unreviewed/2024/04/GHSA-44j5-2jvm-f6f7/GHSA-44j5-2jvm-f6f7.json index fd041f39ccb..f670dca4a0f 100644 --- a/advisories/unreviewed/2024/04/GHSA-44j5-2jvm-f6f7/GHSA-44j5-2jvm-f6f7.json +++ b/advisories/unreviewed/2024/04/GHSA-44j5-2jvm-f6f7/GHSA-44j5-2jvm-f6f7.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-4gqc-44f8-fcvg/GHSA-4gqc-44f8-fcvg.json b/advisories/unreviewed/2024/04/GHSA-4gqc-44f8-fcvg/GHSA-4gqc-44f8-fcvg.json index bbdb512a5ea..0dc2ad82518 100644 --- a/advisories/unreviewed/2024/04/GHSA-4gqc-44f8-fcvg/GHSA-4gqc-44f8-fcvg.json +++ b/advisories/unreviewed/2024/04/GHSA-4gqc-44f8-fcvg/GHSA-4gqc-44f8-fcvg.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4gqc-44f8-fcvg", - "modified": "2024-04-17T12:32:04Z", + "modified": "2025-01-09T18:32:10Z", "published": "2024-04-17T12:32:04Z", "aliases": [ "CVE-2024-26873" @@ -22,6 +22,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/85c98073ffcfe9e46abfb9c66f3364467119d563" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a47f0b03149af538af4442ff0702eac430ace1cb" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/e022dd3b875315a2d2001a512e98d1dc8c991f4a" diff --git a/advisories/unreviewed/2024/04/GHSA-4wc6-f79m-2qgj/GHSA-4wc6-f79m-2qgj.json b/advisories/unreviewed/2024/04/GHSA-4wc6-f79m-2qgj/GHSA-4wc6-f79m-2qgj.json index e8333301b5c..5f3ade2d1d0 100644 --- a/advisories/unreviewed/2024/04/GHSA-4wc6-f79m-2qgj/GHSA-4wc6-f79m-2qgj.json +++ b/advisories/unreviewed/2024/04/GHSA-4wc6-f79m-2qgj/GHSA-4wc6-f79m-2qgj.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-4wcf-973m-cwfg/GHSA-4wcf-973m-cwfg.json b/advisories/unreviewed/2024/04/GHSA-4wcf-973m-cwfg/GHSA-4wcf-973m-cwfg.json index 11c0b8dbc1e..314744219b6 100644 --- a/advisories/unreviewed/2024/04/GHSA-4wcf-973m-cwfg/GHSA-4wcf-973m-cwfg.json +++ b/advisories/unreviewed/2024/04/GHSA-4wcf-973m-cwfg/GHSA-4wcf-973m-cwfg.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-7m59-g97h-p2jv/GHSA-7m59-g97h-p2jv.json b/advisories/unreviewed/2024/04/GHSA-7m59-g97h-p2jv/GHSA-7m59-g97h-p2jv.json index 2e42e2f3d3d..78b4da38247 100644 --- a/advisories/unreviewed/2024/04/GHSA-7m59-g97h-p2jv/GHSA-7m59-g97h-p2jv.json +++ b/advisories/unreviewed/2024/04/GHSA-7m59-g97h-p2jv/GHSA-7m59-g97h-p2jv.json @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-120" + "CWE-120", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/04/GHSA-hw6g-94cf-m7rp/GHSA-hw6g-94cf-m7rp.json b/advisories/unreviewed/2024/04/GHSA-hw6g-94cf-m7rp/GHSA-hw6g-94cf-m7rp.json index 3030658ddc8..0cacdcf026e 100644 --- a/advisories/unreviewed/2024/04/GHSA-hw6g-94cf-m7rp/GHSA-hw6g-94cf-m7rp.json +++ b/advisories/unreviewed/2024/04/GHSA-hw6g-94cf-m7rp/GHSA-hw6g-94cf-m7rp.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-j6hc-65ch-6v6p/GHSA-j6hc-65ch-6v6p.json b/advisories/unreviewed/2024/04/GHSA-j6hc-65ch-6v6p/GHSA-j6hc-65ch-6v6p.json index 51fd74eb924..b7cda8ace59 100644 --- a/advisories/unreviewed/2024/04/GHSA-j6hc-65ch-6v6p/GHSA-j6hc-65ch-6v6p.json +++ b/advisories/unreviewed/2024/04/GHSA-j6hc-65ch-6v6p/GHSA-j6hc-65ch-6v6p.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j6hc-65ch-6v6p", - "modified": "2024-04-09T21:31:58Z", + "modified": "2025-01-09T18:32:08Z", "published": "2024-04-09T21:31:58Z", "aliases": [ "CVE-2024-1463" @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-qh29-9j77-hqw6/GHSA-qh29-9j77-hqw6.json b/advisories/unreviewed/2024/04/GHSA-qh29-9j77-hqw6/GHSA-qh29-9j77-hqw6.json index 315f4c84150..214ad26b88f 100644 --- a/advisories/unreviewed/2024/04/GHSA-qh29-9j77-hqw6/GHSA-qh29-9j77-hqw6.json +++ b/advisories/unreviewed/2024/04/GHSA-qh29-9j77-hqw6/GHSA-qh29-9j77-hqw6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qh29-9j77-hqw6", - "modified": "2024-04-09T21:31:57Z", + "modified": "2025-01-09T18:32:07Z", "published": "2024-04-09T21:31:57Z", "aliases": [ "CVE-2024-1289" @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-639" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-wgqj-wx2p-22jm/GHSA-wgqj-wx2p-22jm.json b/advisories/unreviewed/2024/04/GHSA-wgqj-wx2p-22jm/GHSA-wgqj-wx2p-22jm.json index ece636905a5..f3c73c14cfd 100644 --- a/advisories/unreviewed/2024/04/GHSA-wgqj-wx2p-22jm/GHSA-wgqj-wx2p-22jm.json +++ b/advisories/unreviewed/2024/04/GHSA-wgqj-wx2p-22jm/GHSA-wgqj-wx2p-22jm.json @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-200" + "CWE-200", + "CWE-922" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/05/GHSA-hxrw-3c72-p9hc/GHSA-hxrw-3c72-p9hc.json b/advisories/unreviewed/2024/05/GHSA-hxrw-3c72-p9hc/GHSA-hxrw-3c72-p9hc.json index d898004405a..4280a821e84 100644 --- a/advisories/unreviewed/2024/05/GHSA-hxrw-3c72-p9hc/GHSA-hxrw-3c72-p9hc.json +++ b/advisories/unreviewed/2024/05/GHSA-hxrw-3c72-p9hc/GHSA-hxrw-3c72-p9hc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hxrw-3c72-p9hc", - "modified": "2024-05-21T15:31:38Z", + "modified": "2025-01-09T18:32:11Z", "published": "2024-05-21T15:31:38Z", "aliases": [ "CVE-2024-4452" @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/09/GHSA-78wc-gq29-f2pq/GHSA-78wc-gq29-f2pq.json b/advisories/unreviewed/2024/09/GHSA-78wc-gq29-f2pq/GHSA-78wc-gq29-f2pq.json index c68af1a67a8..2f2b0d6bac7 100644 --- a/advisories/unreviewed/2024/09/GHSA-78wc-gq29-f2pq/GHSA-78wc-gq29-f2pq.json +++ b/advisories/unreviewed/2024/09/GHSA-78wc-gq29-f2pq/GHSA-78wc-gq29-f2pq.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-78wc-gq29-f2pq", - "modified": "2024-09-27T12:31:39Z", + "modified": "2025-01-09T18:32:12Z", "published": "2024-09-27T12:31:39Z", "aliases": [ "CVE-2024-9202" ], "details": "In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested catalog, to ensure that only authorized parties are able to view restricted offers.\nHowever, there is the possibility to request a single dataset, which should be subject to the same filtering process, but currently is missing the correct filtering.\n\n\nThis enables parties to potentially see datasets they should not have access to, thereby exposing sensitive information. Exploiting this vulnerability requires knowing the ID of a restricted dataset, but some IDs may be guessed by trying out many IDs in an automated way.\n\n\nAffected code:\n DatasetResolverImpl, L76-79 https://github.com/eclipse-edc/Connector/blob/v0.9.0/core/control-plane/control-plane-catalog/src/main/java/org/eclipse/edc/connector/controlplane/catalog/DatasetResolverImpl.java", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Amber" diff --git a/advisories/unreviewed/2024/09/GHSA-fv74-m98x-m3w2/GHSA-fv74-m98x-m3w2.json b/advisories/unreviewed/2024/09/GHSA-fv74-m98x-m3w2/GHSA-fv74-m98x-m3w2.json index 183ddfa265a..05d3740009d 100644 --- a/advisories/unreviewed/2024/09/GHSA-fv74-m98x-m3w2/GHSA-fv74-m98x-m3w2.json +++ b/advisories/unreviewed/2024/09/GHSA-fv74-m98x-m3w2/GHSA-fv74-m98x-m3w2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fv74-m98x-m3w2", - "modified": "2024-09-05T18:30:56Z", + "modified": "2025-01-09T18:32:11Z", "published": "2024-09-04T21:30:32Z", "aliases": [ "CVE-2024-44985" @@ -35,6 +35,14 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/975f764e96f71616b530e300c1bb2ac0ce0c2596" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b3a3d5333c13a1be57499581eab4a8fc94d57f36" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c47e022011719fc5727bca661d662303180535ba" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/fc88d6c1f2895a5775795d82ec581afdff7661d1" diff --git a/advisories/unreviewed/2024/10/GHSA-3xm8-389p-x4rm/GHSA-3xm8-389p-x4rm.json b/advisories/unreviewed/2024/10/GHSA-3xm8-389p-x4rm/GHSA-3xm8-389p-x4rm.json index 544fe1e1c7e..d552b3cd85c 100644 --- a/advisories/unreviewed/2024/10/GHSA-3xm8-389p-x4rm/GHSA-3xm8-389p-x4rm.json +++ b/advisories/unreviewed/2024/10/GHSA-3xm8-389p-x4rm/GHSA-3xm8-389p-x4rm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3xm8-389p-x4rm", - "modified": "2024-10-31T00:30:36Z", + "modified": "2025-01-09T18:32:12Z", "published": "2024-10-21T18:30:59Z", "aliases": [ "CVE-2024-49998" @@ -23,6 +23,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/6c24a03a61a245fe34d47582898331fa034b6ccd" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/87bd909a7014e32790e8c759d5b7694a95778ca5" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/ab5d3420a1120950703dbdc33698b28a6ebc3d23" diff --git a/advisories/unreviewed/2024/10/GHSA-m3v4-26gh-289c/GHSA-m3v4-26gh-289c.json b/advisories/unreviewed/2024/10/GHSA-m3v4-26gh-289c/GHSA-m3v4-26gh-289c.json index 24486bfdba7..fe85eb2b98c 100644 --- a/advisories/unreviewed/2024/10/GHSA-m3v4-26gh-289c/GHSA-m3v4-26gh-289c.json +++ b/advisories/unreviewed/2024/10/GHSA-m3v4-26gh-289c/GHSA-m3v4-26gh-289c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m3v4-26gh-289c", - "modified": "2024-10-24T15:31:08Z", + "modified": "2025-01-09T18:32:12Z", "published": "2024-10-21T15:32:26Z", "aliases": [ "CVE-2024-47726" @@ -23,6 +23,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/96cfeb0389530ae32ade8a48ae3ae1ac3b6c009d" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c2a7fc514637f640ff55c3f3e3ed879970814a3f" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/e3db757ff9b7101ae68650ac5f6dd5743b68164e" diff --git a/advisories/unreviewed/2024/11/GHSA-79p2-24v8-gp9v/GHSA-79p2-24v8-gp9v.json b/advisories/unreviewed/2024/11/GHSA-79p2-24v8-gp9v/GHSA-79p2-24v8-gp9v.json index b1eef0070ae..230779d6f9f 100644 --- a/advisories/unreviewed/2024/11/GHSA-79p2-24v8-gp9v/GHSA-79p2-24v8-gp9v.json +++ b/advisories/unreviewed/2024/11/GHSA-79p2-24v8-gp9v/GHSA-79p2-24v8-gp9v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-79p2-24v8-gp9v", - "modified": "2024-11-07T21:31:43Z", + "modified": "2025-01-09T18:32:12Z", "published": "2024-11-05T12:31:03Z", "aliases": [ "CVE-2023-52920" @@ -19,9 +19,17 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52920" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/199f0452873741fa4b8d4d88958e929030b2f92b" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/41f6f64e6999a837048b1bd13a2f8742964eca6b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ecc2aeeaa08a355d84d3ca9c3d2512399a194f29" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/11/GHSA-wrcm-3w95-9w36/GHSA-wrcm-3w95-9w36.json b/advisories/unreviewed/2024/11/GHSA-wrcm-3w95-9w36/GHSA-wrcm-3w95-9w36.json index c1edfd7ca65..73aa1b32c50 100644 --- a/advisories/unreviewed/2024/11/GHSA-wrcm-3w95-9w36/GHSA-wrcm-3w95-9w36.json +++ b/advisories/unreviewed/2024/11/GHSA-wrcm-3w95-9w36/GHSA-wrcm-3w95-9w36.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wrcm-3w95-9w36", - "modified": "2025-01-02T15:31:57Z", + "modified": "2025-01-09T18:32:12Z", "published": "2024-11-05T18:32:12Z", "aliases": [ "CVE-2024-50121" @@ -23,6 +23,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/36775f42e039b01d4abe8998bf66771a37d3cdcc" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5ade4382de16c34d9259cb548f36ec5c4555913c" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/add1df5eba163a3a6ece11cb85890e2e410baaea" @@ -31,6 +35,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/d5ff2fb2e7167e9483846e34148e60c0c016a1f6" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f67138dd338cb564ade7d3755c8cd4f68b46d397" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/f965dc0f099a54fca100acf6909abe52d0c85328" diff --git a/advisories/unreviewed/2024/11/GHSA-xmv6-x39j-72gg/GHSA-xmv6-x39j-72gg.json b/advisories/unreviewed/2024/11/GHSA-xmv6-x39j-72gg/GHSA-xmv6-x39j-72gg.json index f3bfb0e57b6..e6a9e20ce3c 100644 --- a/advisories/unreviewed/2024/11/GHSA-xmv6-x39j-72gg/GHSA-xmv6-x39j-72gg.json +++ b/advisories/unreviewed/2024/11/GHSA-xmv6-x39j-72gg/GHSA-xmv6-x39j-72gg.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xmv6-x39j-72gg", - "modified": "2025-01-02T15:31:57Z", + "modified": "2025-01-09T18:32:12Z", "published": "2024-11-26T00:33:31Z", "aliases": [ "CVE-2024-53099" @@ -19,10 +19,18 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53099" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/24fec234d2ba9ca3c14e545ebe3fd6dcb47f074d" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/4e8074bb33d18f56af30a0252cb3606d27eb1c13" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/79f87a6ec39fb5968049a6775a528bf58b25c20a" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/8421d4c8762bd022cb491f2f0f7019ef51b4f0a7" diff --git a/advisories/unreviewed/2024/12/GHSA-29pg-6wgv-66x3/GHSA-29pg-6wgv-66x3.json b/advisories/unreviewed/2024/12/GHSA-29pg-6wgv-66x3/GHSA-29pg-6wgv-66x3.json index dd1a58ea753..fccc6b0b9c9 100644 --- a/advisories/unreviewed/2024/12/GHSA-29pg-6wgv-66x3/GHSA-29pg-6wgv-66x3.json +++ b/advisories/unreviewed/2024/12/GHSA-29pg-6wgv-66x3/GHSA-29pg-6wgv-66x3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-29pg-6wgv-66x3", - "modified": "2024-12-29T09:30:47Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-29T09:30:47Z", "aliases": [ "CVE-2024-56715" @@ -14,6 +14,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56715" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/87847938f5708b2509b279369c96572254bcf2ba" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/9590d32e090ea2751e131ae5273859ca22f5ac14" diff --git a/advisories/unreviewed/2024/12/GHSA-2fq3-7c2h-3gr7/GHSA-2fq3-7c2h-3gr7.json b/advisories/unreviewed/2024/12/GHSA-2fq3-7c2h-3gr7/GHSA-2fq3-7c2h-3gr7.json index e795f157c9e..523874bf470 100644 --- a/advisories/unreviewed/2024/12/GHSA-2fq3-7c2h-3gr7/GHSA-2fq3-7c2h-3gr7.json +++ b/advisories/unreviewed/2024/12/GHSA-2fq3-7c2h-3gr7/GHSA-2fq3-7c2h-3gr7.json @@ -26,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-667", "CWE-765" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2024/12/GHSA-2qfq-q4fv-fp24/GHSA-2qfq-q4fv-fp24.json b/advisories/unreviewed/2024/12/GHSA-2qfq-q4fv-fp24/GHSA-2qfq-q4fv-fp24.json index 5a86095791f..ae75a951f53 100644 --- a/advisories/unreviewed/2024/12/GHSA-2qfq-q4fv-fp24/GHSA-2qfq-q4fv-fp24.json +++ b/advisories/unreviewed/2024/12/GHSA-2qfq-q4fv-fp24/GHSA-2qfq-q4fv-fp24.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2qfq-q4fv-fp24", - "modified": "2024-12-27T15:31:50Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-27T15:31:50Z", "aliases": [ "CVE-2024-53179" @@ -21,6 +21,10 @@ { "type": "WEB", "url": "https://git.kernel.org/stable/c/343d7fe6df9e247671440a932b6a73af4fa86d95" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/39619c65ab4bbb3e78c818f537687653e112764d" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/12/GHSA-3747-237p-gqq2/GHSA-3747-237p-gqq2.json b/advisories/unreviewed/2024/12/GHSA-3747-237p-gqq2/GHSA-3747-237p-gqq2.json index ac841bae575..9db4c6857d5 100644 --- a/advisories/unreviewed/2024/12/GHSA-3747-237p-gqq2/GHSA-3747-237p-gqq2.json +++ b/advisories/unreviewed/2024/12/GHSA-3747-237p-gqq2/GHSA-3747-237p-gqq2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3747-237p-gqq2", - "modified": "2024-12-27T15:31:54Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-27T15:31:54Z", "aliases": [ "CVE-2024-56582" @@ -18,6 +18,14 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/05b36b04d74a517d6675bf2f90829ff1ac7e28dc" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6228f13f1996a4feb9b601d6644bf0bfe03671dd" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a40de0330af4fb7bc6b354250c24f294f8b826a0" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/f8a5129e4a9fc3f6aa3f137513253b51b31b94d4" diff --git a/advisories/unreviewed/2024/12/GHSA-4vvx-v299-79g8/GHSA-4vvx-v299-79g8.json b/advisories/unreviewed/2024/12/GHSA-4vvx-v299-79g8/GHSA-4vvx-v299-79g8.json index bb66853dfd3..6437c31ab3f 100644 --- a/advisories/unreviewed/2024/12/GHSA-4vvx-v299-79g8/GHSA-4vvx-v299-79g8.json +++ b/advisories/unreviewed/2024/12/GHSA-4vvx-v299-79g8/GHSA-4vvx-v299-79g8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4vvx-v299-79g8", - "modified": "2024-12-27T15:31:50Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-27T15:31:50Z", "aliases": [ "CVE-2024-53164" @@ -14,10 +14,22 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53164" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/33db36b3c53d0fda2699ea39ba72bee4de8336e8" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/44782565e1e6174c94bddfa72ac7267cd09c1648" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/489422e2befff88a1de52b2acebe7b333bded025" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5e473f462a16f1a34e49ea4289a667d2e4f35b52" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/5eb7de8cd58e73851cd37ff8d0666517d9926948" diff --git a/advisories/unreviewed/2024/12/GHSA-5h7h-rvjv-q33c/GHSA-5h7h-rvjv-q33c.json b/advisories/unreviewed/2024/12/GHSA-5h7h-rvjv-q33c/GHSA-5h7h-rvjv-q33c.json index 9b97ccb287b..681630d89ec 100644 --- a/advisories/unreviewed/2024/12/GHSA-5h7h-rvjv-q33c/GHSA-5h7h-rvjv-q33c.json +++ b/advisories/unreviewed/2024/12/GHSA-5h7h-rvjv-q33c/GHSA-5h7h-rvjv-q33c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5h7h-rvjv-q33c", - "modified": "2024-12-27T15:31:54Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-27T15:31:54Z", "aliases": [ "CVE-2024-56607" @@ -18,6 +18,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/2093f062b26805789b73f2af214691475d9baa29" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3ed6b2daa4e9029987885f86835ffbc003d11c01" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/8fac3266c68a8e647240b8ac8d0b82f1821edf85" diff --git a/advisories/unreviewed/2024/12/GHSA-6f5r-5mjv-2p43/GHSA-6f5r-5mjv-2p43.json b/advisories/unreviewed/2024/12/GHSA-6f5r-5mjv-2p43/GHSA-6f5r-5mjv-2p43.json index 1d44b7cc32c..0efb70f5649 100644 --- a/advisories/unreviewed/2024/12/GHSA-6f5r-5mjv-2p43/GHSA-6f5r-5mjv-2p43.json +++ b/advisories/unreviewed/2024/12/GHSA-6f5r-5mjv-2p43/GHSA-6f5r-5mjv-2p43.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6f5r-5mjv-2p43", - "modified": "2025-01-09T00:31:33Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-27T15:31:54Z", "aliases": [ "CVE-2024-56588" @@ -23,6 +23,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/6c55f99123075e5429850b41b06f7dfffcb708eb" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7c8c50c9855a9e1b0d1e3680e5ad839002a9deb5" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/9f564f15f88490b484e02442dc4c4b11640ea172" diff --git a/advisories/unreviewed/2024/12/GHSA-74p7-5m3q-64m6/GHSA-74p7-5m3q-64m6.json b/advisories/unreviewed/2024/12/GHSA-74p7-5m3q-64m6/GHSA-74p7-5m3q-64m6.json index 942674986ef..3a3dfdc1b3d 100644 --- a/advisories/unreviewed/2024/12/GHSA-74p7-5m3q-64m6/GHSA-74p7-5m3q-64m6.json +++ b/advisories/unreviewed/2024/12/GHSA-74p7-5m3q-64m6/GHSA-74p7-5m3q-64m6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-74p7-5m3q-64m6", - "modified": "2024-12-27T15:31:54Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-27T15:31:54Z", "aliases": [ "CVE-2024-56609" @@ -14,6 +14,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56609" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3d94c4b21966b49c3e26ceeefacaa11ff7ee6d68" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/3e5e4a801aaf4283390cc34959c6c48f910ca5ea" diff --git a/advisories/unreviewed/2024/12/GHSA-7822-7h76-h235/GHSA-7822-7h76-h235.json b/advisories/unreviewed/2024/12/GHSA-7822-7h76-h235/GHSA-7822-7h76-h235.json index fe13ac11671..d442a8de511 100644 --- a/advisories/unreviewed/2024/12/GHSA-7822-7h76-h235/GHSA-7822-7h76-h235.json +++ b/advisories/unreviewed/2024/12/GHSA-7822-7h76-h235/GHSA-7822-7h76-h235.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7822-7h76-h235", - "modified": "2024-12-27T15:31:55Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-27T15:31:55Z", "aliases": [ "CVE-2024-56627" @@ -18,6 +18,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/27de4295522e9a33e4a3fc72f7b8193df9eebe41" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6bd1bf0e8c42f10a9a9679a4c103a9032d30594d" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/81eed631935f2c52cdaf6691c6d48e0b06e8ad73" diff --git a/advisories/unreviewed/2024/12/GHSA-8896-pxp4-28pj/GHSA-8896-pxp4-28pj.json b/advisories/unreviewed/2024/12/GHSA-8896-pxp4-28pj/GHSA-8896-pxp4-28pj.json index 2d5490791cc..56840354e3f 100644 --- a/advisories/unreviewed/2024/12/GHSA-8896-pxp4-28pj/GHSA-8896-pxp4-28pj.json +++ b/advisories/unreviewed/2024/12/GHSA-8896-pxp4-28pj/GHSA-8896-pxp4-28pj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8896-pxp4-28pj", - "modified": "2024-12-29T09:30:47Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-29T09:30:47Z", "aliases": [ "CVE-2024-56716" @@ -18,10 +18,18 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/470c5ecbac2f19b1cdee2a6ce8d5650c3295c94b" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/81bdfcd6e6a998e219c9dd49ec7291c2e0594bbc" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/8e9ef6bdf71bf25f4735e0230ce1919de8985835" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b3a6daaf7cfb2de37b89fd7a5a2ad4ea9aa3e181" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/d10321be26ff9e9e912697e9e8448099654ff561" diff --git a/advisories/unreviewed/2024/12/GHSA-f225-f9rp-hg69/GHSA-f225-f9rp-hg69.json b/advisories/unreviewed/2024/12/GHSA-f225-f9rp-hg69/GHSA-f225-f9rp-hg69.json index 50e0b775fce..9c6f6b6ea01 100644 --- a/advisories/unreviewed/2024/12/GHSA-f225-f9rp-hg69/GHSA-f225-f9rp-hg69.json +++ b/advisories/unreviewed/2024/12/GHSA-f225-f9rp-hg69/GHSA-f225-f9rp-hg69.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-f225-f9rp-hg69", - "modified": "2025-01-08T18:30:48Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-28T12:30:47Z", "aliases": [ "CVE-2024-56694" @@ -23,6 +23,14 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/01f1b88acfd79103da0610b45471f6c88ea98d72" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/078f7e1521442a55db4bed812a2fbaf02ac33819" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/221109ba2127eabd0aa64718543638b58b15df56" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/386efa339e08563dd33e83bc951aea5d407fe578" diff --git a/advisories/unreviewed/2024/12/GHSA-g4vc-rr66-6355/GHSA-g4vc-rr66-6355.json b/advisories/unreviewed/2024/12/GHSA-g4vc-rr66-6355/GHSA-g4vc-rr66-6355.json index 41e83e68dbd..9f21d82d16a 100644 --- a/advisories/unreviewed/2024/12/GHSA-g4vc-rr66-6355/GHSA-g4vc-rr66-6355.json +++ b/advisories/unreviewed/2024/12/GHSA-g4vc-rr66-6355/GHSA-g4vc-rr66-6355.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g4vc-rr66-6355", - "modified": "2024-12-27T15:31:55Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-27T15:31:55Z", "aliases": [ "CVE-2024-56626" @@ -18,6 +18,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/164d3597d26d9acff5d5b8bc3208bdcca942dd6a" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1aea5c9470be2c7129704fb1b9562b1e3e0576f8" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/313dab082289e460391c82d855430ec8a28ddf81" diff --git a/advisories/unreviewed/2024/12/GHSA-g5w9-m9r4-63pr/GHSA-g5w9-m9r4-63pr.json b/advisories/unreviewed/2024/12/GHSA-g5w9-m9r4-63pr/GHSA-g5w9-m9r4-63pr.json index c1a09bfdec8..f2583370b6a 100644 --- a/advisories/unreviewed/2024/12/GHSA-g5w9-m9r4-63pr/GHSA-g5w9-m9r4-63pr.json +++ b/advisories/unreviewed/2024/12/GHSA-g5w9-m9r4-63pr/GHSA-g5w9-m9r4-63pr.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-g5w9-m9r4-63pr", - "modified": "2024-12-28T06:30:22Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-28T06:30:22Z", "aliases": [ "CVE-2024-46972" ], "details": "Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-911" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-28T05:15:08Z" diff --git a/advisories/unreviewed/2024/12/GHSA-gfwf-x23p-xh3q/GHSA-gfwf-x23p-xh3q.json b/advisories/unreviewed/2024/12/GHSA-gfwf-x23p-xh3q/GHSA-gfwf-x23p-xh3q.json index 8d8f172f565..66f089b2b54 100644 --- a/advisories/unreviewed/2024/12/GHSA-gfwf-x23p-xh3q/GHSA-gfwf-x23p-xh3q.json +++ b/advisories/unreviewed/2024/12/GHSA-gfwf-x23p-xh3q/GHSA-gfwf-x23p-xh3q.json @@ -34,7 +34,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-120" + "CWE-120", + "CWE-94" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/12/GHSA-ghmx-w25c-9jmr/GHSA-ghmx-w25c-9jmr.json b/advisories/unreviewed/2024/12/GHSA-ghmx-w25c-9jmr/GHSA-ghmx-w25c-9jmr.json index b161e1f1483..069078b822c 100644 --- a/advisories/unreviewed/2024/12/GHSA-ghmx-w25c-9jmr/GHSA-ghmx-w25c-9jmr.json +++ b/advisories/unreviewed/2024/12/GHSA-ghmx-w25c-9jmr/GHSA-ghmx-w25c-9jmr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-ghmx-w25c-9jmr", - "modified": "2024-12-27T15:31:55Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-27T15:31:55Z", "aliases": [ "CVE-2024-56616" @@ -14,10 +14,18 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56616" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/109f91d8b9335b0f3714ef9920eae5a8b21d56af" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/1fc1f32c4a3421b9d803f18ec3ef49db2fb5d5ef" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/70e7166612f4e6da8d7d0305c47c465d88d037e5" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/780fa184d4dc38ad6c4fded345ab8f9be7a63e96" diff --git a/advisories/unreviewed/2024/12/GHSA-h88r-39vx-9655/GHSA-h88r-39vx-9655.json b/advisories/unreviewed/2024/12/GHSA-h88r-39vx-9655/GHSA-h88r-39vx-9655.json index 12b9fc1d347..fb790b33902 100644 --- a/advisories/unreviewed/2024/12/GHSA-h88r-39vx-9655/GHSA-h88r-39vx-9655.json +++ b/advisories/unreviewed/2024/12/GHSA-h88r-39vx-9655/GHSA-h88r-39vx-9655.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-h88r-39vx-9655", - "modified": "2025-01-09T00:31:33Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-27T15:31:54Z", "aliases": [ "CVE-2024-56599" @@ -26,6 +26,10 @@ { "type": "WEB", "url": "https://git.kernel.org/stable/c/95c38953cb1ecf40399a676a1f85dfe2b5780a9a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b35de9e01fc79c7baac666fb2dcb4ba7698a1d97" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/12/GHSA-hc38-wh54-qgvx/GHSA-hc38-wh54-qgvx.json b/advisories/unreviewed/2024/12/GHSA-hc38-wh54-qgvx/GHSA-hc38-wh54-qgvx.json index 5557c11562b..2e52c6dabe4 100644 --- a/advisories/unreviewed/2024/12/GHSA-hc38-wh54-qgvx/GHSA-hc38-wh54-qgvx.json +++ b/advisories/unreviewed/2024/12/GHSA-hc38-wh54-qgvx/GHSA-hc38-wh54-qgvx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hc38-wh54-qgvx", - "modified": "2024-12-18T09:31:35Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-18T09:31:35Z", "aliases": [ "CVE-2024-11614" @@ -19,6 +19,30 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11614" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0208" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0209" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0210" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0220" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0221" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0222" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-11614" diff --git a/advisories/unreviewed/2024/12/GHSA-j32h-9rm6-p2c5/GHSA-j32h-9rm6-p2c5.json b/advisories/unreviewed/2024/12/GHSA-j32h-9rm6-p2c5/GHSA-j32h-9rm6-p2c5.json index 9b422089f49..a145f6d2d4f 100644 --- a/advisories/unreviewed/2024/12/GHSA-j32h-9rm6-p2c5/GHSA-j32h-9rm6-p2c5.json +++ b/advisories/unreviewed/2024/12/GHSA-j32h-9rm6-p2c5/GHSA-j32h-9rm6-p2c5.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-j32h-9rm6-p2c5", - "modified": "2024-12-19T21:31:11Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-19T21:31:11Z", "aliases": [ "CVE-2024-2201" ], "details": "A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [], "references": [ { @@ -53,7 +58,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-19T21:15:08Z" diff --git a/advisories/unreviewed/2024/12/GHSA-qfgm-256j-rghm/GHSA-qfgm-256j-rghm.json b/advisories/unreviewed/2024/12/GHSA-qfgm-256j-rghm/GHSA-qfgm-256j-rghm.json index f80bcf206ff..d87c20cd19a 100644 --- a/advisories/unreviewed/2024/12/GHSA-qfgm-256j-rghm/GHSA-qfgm-256j-rghm.json +++ b/advisories/unreviewed/2024/12/GHSA-qfgm-256j-rghm/GHSA-qfgm-256j-rghm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qfgm-256j-rghm", - "modified": "2025-01-07T18:30:46Z", + "modified": "2025-01-09T18:32:13Z", "published": "2024-12-24T12:30:42Z", "aliases": [ "CVE-2024-53149" @@ -27,6 +27,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/6ba6f7f29e0dff47a2799e60dcd1b5c29cd811a5" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8a2273e5c1beb285729aa001422967b4711c53fe" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/9a5a8b5bd72169aa7a8ec800ef57be2f2cb4d9b2" diff --git a/advisories/unreviewed/2025/01/GHSA-28xv-h724-wvrh/GHSA-28xv-h724-wvrh.json b/advisories/unreviewed/2025/01/GHSA-28xv-h724-wvrh/GHSA-28xv-h724-wvrh.json index c6d870d98de..d8f39513a30 100644 --- a/advisories/unreviewed/2025/01/GHSA-28xv-h724-wvrh/GHSA-28xv-h724-wvrh.json +++ b/advisories/unreviewed/2025/01/GHSA-28xv-h724-wvrh/GHSA-28xv-h724-wvrh.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-28xv-h724-wvrh", - "modified": "2025-01-09T06:30:24Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-09T06:30:24Z", "aliases": [ "CVE-2024-12714" ], "details": "The Backlink Monitoring Manager WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-09T06:15:14Z" diff --git a/advisories/unreviewed/2025/01/GHSA-29j5-jrp6-rrmp/GHSA-29j5-jrp6-rrmp.json b/advisories/unreviewed/2025/01/GHSA-29j5-jrp6-rrmp/GHSA-29j5-jrp6-rrmp.json new file mode 100644 index 00000000000..f2bb11a3095 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-29j5-jrp6-rrmp/GHSA-29j5-jrp6-rrmp.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-29j5-jrp6-rrmp", + "modified": "2025-01-09T18:32:13Z", + "published": "2025-01-09T18:32:13Z", + "aliases": [ + "CVE-2025-22307" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeAstrology Team Product Table for WooCommerce allows Reflected XSS.This issue affects Product Table for WooCommerce: from n/a through 3.5.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22307" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/woo-product-table/vulnerability/wordpress-product-table-for-woocommerce-plugin-3-5-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-2v4c-p54v-w3r7/GHSA-2v4c-p54v-w3r7.json b/advisories/unreviewed/2025/01/GHSA-2v4c-p54v-w3r7/GHSA-2v4c-p54v-w3r7.json new file mode 100644 index 00000000000..a2085a9c93c --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-2v4c-p54v-w3r7/GHSA-2v4c-p54v-w3r7.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2v4c-p54v-w3r7", + "modified": "2025-01-09T18:32:13Z", + "published": "2025-01-09T18:32:13Z", + "aliases": [ + "CVE-2025-22345" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tobias Spiess TS Comfort DB allows Reflected XSS.This issue affects TS Comfort DB: from n/a through 2.0.7.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22345" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/ts-comfort-database/vulnerability/wordpress-ts-comfort-db-plugin-2-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-3hw8-52j6-h699/GHSA-3hw8-52j6-h699.json b/advisories/unreviewed/2025/01/GHSA-3hw8-52j6-h699/GHSA-3hw8-52j6-h699.json new file mode 100644 index 00000000000..7aeeb3d9c39 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-3hw8-52j6-h699/GHSA-3hw8-52j6-h699.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3hw8-52j6-h699", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22807" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Peake Responsive Flickr Slideshow allows Stored XSS.This issue affects Responsive Flickr Slideshow: from n/a through 2.6.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22807" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/mobile-friendly-flickr-slideshow/vulnerability/wordpress-responsive-flickr-slideshow-plugin-2-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-3pjr-fmjg-gm5p/GHSA-3pjr-fmjg-gm5p.json b/advisories/unreviewed/2025/01/GHSA-3pjr-fmjg-gm5p/GHSA-3pjr-fmjg-gm5p.json new file mode 100644 index 00000000000..5ae916a74a6 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-3pjr-fmjg-gm5p/GHSA-3pjr-fmjg-gm5p.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3pjr-fmjg-gm5p", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22806" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor allows DOM-Based XSS.This issue affects Black Widgets For Elementor: from n/a through 1.3.8.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22806" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/black-widgets/vulnerability/wordpress-black-widgets-for-elementor-plugin-1-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-3r2h-9pcp-cj9v/GHSA-3r2h-9pcp-cj9v.json b/advisories/unreviewed/2025/01/GHSA-3r2h-9pcp-cj9v/GHSA-3r2h-9pcp-cj9v.json new file mode 100644 index 00000000000..557fdc5198d --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-3r2h-9pcp-cj9v/GHSA-3r2h-9pcp-cj9v.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3r2h-9pcp-cj9v", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22821" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vfthemes StorePress allows DOM-Based XSS.This issue affects StorePress: from n/a through 1.0.12.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22821" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/theme/storepress/vulnerability/wordpress-storepress-theme-1-0-12-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-3rpg-hvp5-w7r8/GHSA-3rpg-hvp5-w7r8.json b/advisories/unreviewed/2025/01/GHSA-3rpg-hvp5-w7r8/GHSA-3rpg-hvp5-w7r8.json new file mode 100644 index 00000000000..b8b1590b69f --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-3rpg-hvp5-w7r8/GHSA-3rpg-hvp5-w7r8.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3rpg-hvp5-w7r8", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22804" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through 2.1.23.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22804" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/author-avatars/vulnerability/wordpress-author-avatars-list-block-plugin-2-1-23-stored-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-3wvw-m4vx-cj7h/GHSA-3wvw-m4vx-cj7h.json b/advisories/unreviewed/2025/01/GHSA-3wvw-m4vx-cj7h/GHSA-3wvw-m4vx-cj7h.json new file mode 100644 index 00000000000..c52bf20bef2 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-3wvw-m4vx-cj7h/GHSA-3wvw-m4vx-cj7h.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3wvw-m4vx-cj7h", + "modified": "2025-01-09T18:32:15Z", + "published": "2025-01-09T18:32:15Z", + "aliases": [ + "CVE-2025-21593" + ], + "details": "An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS).\n\nOn devices with SRv6 (Segment Routing over IPv6) enabled, an attacker can send a malformed BGP UPDATE packet which will cause the rpd to crash and restart. Continued receipt of these UPDATE packets will cause a sustained DoS condition. \n\nThis issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.This issue affects Junos OS: \n\n\n\n * All versions before 21.2R3-S9, \n * from 21.4 before 21.4R3-S10, \n * from 22.2 before 22.2R3-S5, \n * from 22.3 before 22.3R3-S4, \n * from 22.4 before 22.4R3-S3, \n * from 23.2 before 23.2R2-S2, \n * from 23.4 before 23.4R2;\n\n\n\nand Junos OS Evolved: \n\n\n\n * All versions before 21.2R3-S9-EVO, \n * from 21.4-EVO before 21.4R3-S10-EVO, \n * from 22.2-EVO before 22.2R3-S5-EVO, \n * from 22.3-EVO before 22.3R3-S4-EVO, \n * from 22.4-EVO before 22.4R3-S3-EVO,\n * from 23.2-EVO before 23.2R2-S2-EVO, \n * from 23.4-EVO before 23.4R2-EVO.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21593" + }, + { + "type": "WEB", + "url": "https://supportportal.juniper.net/JSA92861" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-664" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T17:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-3x59-4xhf-3r9c/GHSA-3x59-4xhf-3r9c.json b/advisories/unreviewed/2025/01/GHSA-3x59-4xhf-3r9c/GHSA-3x59-4xhf-3r9c.json new file mode 100644 index 00000000000..5fae708ede0 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-3x59-4xhf-3r9c/GHSA-3x59-4xhf-3r9c.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3x59-4xhf-3r9c", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22810" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CBB Team Content Blocks Builder allows Stored XSS.This issue affects Content Blocks Builder: from n/a through 2.7.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22810" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/content-blocks-builder/vulnerability/wordpress-content-blocks-builder-plugin-2-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-4xr4-6fc5-qgmh/GHSA-4xr4-6fc5-qgmh.json b/advisories/unreviewed/2025/01/GHSA-4xr4-6fc5-qgmh/GHSA-4xr4-6fc5-qgmh.json new file mode 100644 index 00000000000..5aa0eec46ee --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-4xr4-6fc5-qgmh/GHSA-4xr4-6fc5-qgmh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4xr4-6fc5-qgmh", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22537" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in traveller11 Google Maps Travel Route allows SQL Injection.This issue affects Google Maps Travel Route: from n/a through 1.3.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22537" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/google-maps-travel-route/vulnerability/wordpress-google-maps-travel-route-plugin-1-3-1-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-52wr-wgrx-pgjh/GHSA-52wr-wgrx-pgjh.json b/advisories/unreviewed/2025/01/GHSA-52wr-wgrx-pgjh/GHSA-52wr-wgrx-pgjh.json new file mode 100644 index 00000000000..519fba22d94 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-52wr-wgrx-pgjh/GHSA-52wr-wgrx-pgjh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-52wr-wgrx-pgjh", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22803" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Advanced Product Information for WooCommerce allows Stored XSS.This issue affects Advanced Product Information for WooCommerce: from n/a through 1.1.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22803" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/woo-advanced-product-information/vulnerability/wordpress-advanced-product-information-for-woocommerce-plugin-1-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-53v5-6gjc-59jx/GHSA-53v5-6gjc-59jx.json b/advisories/unreviewed/2025/01/GHSA-53v5-6gjc-59jx/GHSA-53v5-6gjc-59jx.json new file mode 100644 index 00000000000..091ca939218 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-53v5-6gjc-59jx/GHSA-53v5-6gjc-59jx.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-53v5-6gjc-59jx", + "modified": "2025-01-09T18:32:13Z", + "published": "2025-01-09T18:32:13Z", + "aliases": [ + "CVE-2025-22361" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Opentracker Opentracker Analytics allows Reflected XSS.This issue affects Opentracker Analytics: from n/a through 1.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22361" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/opentracker-analytics/vulnerability/wordpress-opentracker-analytics-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-5j7v-r7c4-269c/GHSA-5j7v-r7c4-269c.json b/advisories/unreviewed/2025/01/GHSA-5j7v-r7c4-269c/GHSA-5j7v-r7c4-269c.json new file mode 100644 index 00000000000..76ba1833529 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-5j7v-r7c4-269c/GHSA-5j7v-r7c4-269c.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5j7v-r7c4-269c", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22819" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 4wpbari Qr Code and Barcode Scanner Reader allows Stored XSS.This issue affects Qr Code and Barcode Scanner Reader: from n/a through 1.0.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22819" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/qr-code-and-barcode-scanner-reader/vulnerability/wordpress-qr-code-and-barcode-scanner-reader-plugin-1-0-0-stored-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-5mpw-2vmf-gm8p/GHSA-5mpw-2vmf-gm8p.json b/advisories/unreviewed/2025/01/GHSA-5mpw-2vmf-gm8p/GHSA-5mpw-2vmf-gm8p.json new file mode 100644 index 00000000000..1b99c67df10 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-5mpw-2vmf-gm8p/GHSA-5mpw-2vmf-gm8p.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5mpw-2vmf-gm8p", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22820" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Walmsley VR Views allows Stored XSS.This issue affects VR Views: from n/a through 1.5.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22820" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/vr-views/vulnerability/wordpress-vr-views-plugin-1-5-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-5r7w-j22r-58j4/GHSA-5r7w-j22r-58j4.json b/advisories/unreviewed/2025/01/GHSA-5r7w-j22r-58j4/GHSA-5r7w-j22r-58j4.json index f1ba79db2e7..0bdef8cd50f 100644 --- a/advisories/unreviewed/2025/01/GHSA-5r7w-j22r-58j4/GHSA-5r7w-j22r-58j4.json +++ b/advisories/unreviewed/2025/01/GHSA-5r7w-j22r-58j4/GHSA-5r7w-j22r-58j4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5r7w-j22r-58j4", - "modified": "2025-01-08T00:30:49Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-06T18:31:04Z", "aliases": [ "CVE-2024-56766" @@ -19,10 +19,22 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56766" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1562871ef613fa9492aa0310933eff785166a90e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3d825a241e65f7e3072978729e79d735ec40b80e" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/6ea15205d7e2b811fbbdf79783f686f58abfb4b7" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ca9818554b0f33e87f38e4bfa2dac056692d46cc" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/d2f090ea57f8d6587e09d4066f740a8617767b3d" diff --git a/advisories/unreviewed/2025/01/GHSA-6574-vqv8-9334/GHSA-6574-vqv8-9334.json b/advisories/unreviewed/2025/01/GHSA-6574-vqv8-9334/GHSA-6574-vqv8-9334.json index 504a60c65c6..bb76a7215d1 100644 --- a/advisories/unreviewed/2025/01/GHSA-6574-vqv8-9334/GHSA-6574-vqv8-9334.json +++ b/advisories/unreviewed/2025/01/GHSA-6574-vqv8-9334/GHSA-6574-vqv8-9334.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6574-vqv8-9334", - "modified": "2025-01-08T00:30:49Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-06T18:31:03Z", "aliases": [ "CVE-2024-56759" @@ -23,6 +23,22 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/44f52bbe96dfdbe4aca3818a2534520082a07040" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/526ff5b27f090fb15040471f892cd2c9899ce314" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/66376f1a73cba57fd0af2631d7888605b738e499" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9a466b8693b9add05de99af00c7bdff8259ecf19" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ba5120a2fb5f23b4d39d302e181aa5d4e28a90d1" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/c3a403d8ce36f5a809a492581de5ad17843e4701" diff --git a/advisories/unreviewed/2025/01/GHSA-65jw-2x36-2chq/GHSA-65jw-2x36-2chq.json b/advisories/unreviewed/2025/01/GHSA-65jw-2x36-2chq/GHSA-65jw-2x36-2chq.json new file mode 100644 index 00000000000..1b5f071482e --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-65jw-2x36-2chq/GHSA-65jw-2x36-2chq.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-65jw-2x36-2chq", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:13Z", + "aliases": [ + "CVE-2025-22330" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Waghmare MG Parallax Slider allows Reflected XSS.This issue affects MG Parallax Slider: from n/a through 1.0..", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22330" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/mg-parallax-slider/vulnerability/wordpress-mg-parallax-slider-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-69x2-xg7w-gr22/GHSA-69x2-xg7w-gr22.json b/advisories/unreviewed/2025/01/GHSA-69x2-xg7w-gr22/GHSA-69x2-xg7w-gr22.json new file mode 100644 index 00000000000..af5a7383f0a --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-69x2-xg7w-gr22/GHSA-69x2-xg7w-gr22.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-69x2-xg7w-gr22", + "modified": "2025-01-09T18:32:13Z", + "published": "2025-01-09T18:32:13Z", + "aliases": [ + "CVE-2025-22313" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light allows Reflected XSS.This issue affects Widgetize Pages Light: from n/a through 3.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22313" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/widgetize-pages-light/vulnerability/wordpress-widgetize-pages-light-plugin-3-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-6xfq-wgr5-vqc6/GHSA-6xfq-wgr5-vqc6.json b/advisories/unreviewed/2025/01/GHSA-6xfq-wgr5-vqc6/GHSA-6xfq-wgr5-vqc6.json new file mode 100644 index 00000000000..fb0cbc280e8 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-6xfq-wgr5-vqc6/GHSA-6xfq-wgr5-vqc6.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6xfq-wgr5-vqc6", + "modified": "2025-01-09T18:32:13Z", + "published": "2025-01-09T18:32:13Z", + "aliases": [ + "CVE-2025-22295" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto allows Stored XSS.This issue affects WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: from n/a through 8.0.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22295" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/tripetto/vulnerability/wordpress-tripetto-plugin-8-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-72fx-77qc-qgxv/GHSA-72fx-77qc-qgxv.json b/advisories/unreviewed/2025/01/GHSA-72fx-77qc-qgxv/GHSA-72fx-77qc-qgxv.json new file mode 100644 index 00000000000..c7ab4255523 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-72fx-77qc-qgxv/GHSA-72fx-77qc-qgxv.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-72fx-77qc-qgxv", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22521" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Farrell wp Hosting Performance Check allows Reflected XSS.This issue affects wp Hosting Performance Check: from n/a through 2.18.8.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22521" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-hosting-performance-check/vulnerability/wordpress-wp-hosting-performance-check-plugin-2-18-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-72qg-x4rx-vrx3/GHSA-72qg-x4rx-vrx3.json b/advisories/unreviewed/2025/01/GHSA-72qg-x4rx-vrx3/GHSA-72qg-x4rx-vrx3.json index ac1cc9c6b4c..9bcd27d4f16 100644 --- a/advisories/unreviewed/2025/01/GHSA-72qg-x4rx-vrx3/GHSA-72qg-x4rx-vrx3.json +++ b/advisories/unreviewed/2025/01/GHSA-72qg-x4rx-vrx3/GHSA-72qg-x4rx-vrx3.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-72qg-x4rx-vrx3", - "modified": "2025-01-09T06:30:23Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-09T06:30:23Z", "aliases": [ "CVE-2024-10815" ], "details": "The PostLists WordPress plugin through 2.0.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -21,7 +26,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-09T06:15:14Z" diff --git a/advisories/unreviewed/2025/01/GHSA-742f-x9vh-cvq8/GHSA-742f-x9vh-cvq8.json b/advisories/unreviewed/2025/01/GHSA-742f-x9vh-cvq8/GHSA-742f-x9vh-cvq8.json new file mode 100644 index 00000000000..933a523fc72 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-742f-x9vh-cvq8/GHSA-742f-x9vh-cvq8.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-742f-x9vh-cvq8", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22818" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S3Bubble S3Player – WooCommerce & Elementor Integration allows Stored XSS.This issue affects S3Player – WooCommerce & Elementor Integration: from n/a through 4.2.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22818" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/drm-protected-video-streaming/vulnerability/wordpress-s3player-plugin-4-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-764j-f3m9-c8mh/GHSA-764j-f3m9-c8mh.json b/advisories/unreviewed/2025/01/GHSA-764j-f3m9-c8mh/GHSA-764j-f3m9-c8mh.json new file mode 100644 index 00000000000..8f0d9220f87 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-764j-f3m9-c8mh/GHSA-764j-f3m9-c8mh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-764j-f3m9-c8mh", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22594" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hccoder – Sándor Fodor Better User Shortcodes allows Reflected XSS.This issue affects Better User Shortcodes: from n/a through 1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22594" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/better-user-shortcodes/vulnerability/wordpress-better-user-shortcodes-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-8663-r3qp-qv79/GHSA-8663-r3qp-qv79.json b/advisories/unreviewed/2025/01/GHSA-8663-r3qp-qv79/GHSA-8663-r3qp-qv79.json new file mode 100644 index 00000000000..6496647f026 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-8663-r3qp-qv79/GHSA-8663-r3qp-qv79.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8663-r3qp-qv79", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22535" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jonathan Kern WPListCal allows SQL Injection.This issue affects WPListCal: from n/a through 1.3.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22535" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wplistcal/vulnerability/wordpress-wplistcal-plugin-1-3-5-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-8c7p-q8m4-m3pg/GHSA-8c7p-q8m4-m3pg.json b/advisories/unreviewed/2025/01/GHSA-8c7p-q8m4-m3pg/GHSA-8c7p-q8m4-m3pg.json new file mode 100644 index 00000000000..956b647f9c2 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-8c7p-q8m4-m3pg/GHSA-8c7p-q8m4-m3pg.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8c7p-q8m4-m3pg", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22505" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabaraj Chapagain NC Wishlist for Woocommerce allows SQL Injection.This issue affects NC Wishlist for Woocommerce: from n/a through 1.0.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22505" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/nc-wishlist-for-woocommerce/vulnerability/wordpress-nc-wishlist-for-woocommerce-plugin-1-0-1-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-8p2p-qc6p-2hr2/GHSA-8p2p-qc6p-2hr2.json b/advisories/unreviewed/2025/01/GHSA-8p2p-qc6p-2hr2/GHSA-8p2p-qc6p-2hr2.json index 22787caf6c1..9a5672759c3 100644 --- a/advisories/unreviewed/2025/01/GHSA-8p2p-qc6p-2hr2/GHSA-8p2p-qc6p-2hr2.json +++ b/advisories/unreviewed/2025/01/GHSA-8p2p-qc6p-2hr2/GHSA-8p2p-qc6p-2hr2.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-8p2p-qc6p-2hr2", - "modified": "2025-01-09T06:30:24Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-09T06:30:24Z", "aliases": [ "CVE-2024-12731" ], "details": "The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -21,7 +26,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-09T06:15:15Z" diff --git a/advisories/unreviewed/2025/01/GHSA-8p53-58vm-93qv/GHSA-8p53-58vm-93qv.json b/advisories/unreviewed/2025/01/GHSA-8p53-58vm-93qv/GHSA-8p53-58vm-93qv.json new file mode 100644 index 00000000000..a346b095558 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-8p53-58vm-93qv/GHSA-8p53-58vm-93qv.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8p53-58vm-93qv", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22595" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yamna Khawaja Mailing Group Listserv allows Reflected XSS.This issue affects Mailing Group Listserv: from n/a through 2.0.9.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22595" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-mailing-group/vulnerability/wordpress-mailing-group-listserv-plugin-2-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-8v2f-ggrg-q9f6/GHSA-8v2f-ggrg-q9f6.json b/advisories/unreviewed/2025/01/GHSA-8v2f-ggrg-q9f6/GHSA-8v2f-ggrg-q9f6.json new file mode 100644 index 00000000000..90bee91f6d4 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-8v2f-ggrg-q9f6/GHSA-8v2f-ggrg-q9f6.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8v2f-ggrg-q9f6", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22508" + ], + "details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Roninwp FAT Event Lite allows PHP Local File Inclusion.This issue affects FAT Event Lite: from n/a through 1.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22508" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/fat-event-lite/vulnerability/wordpress-fat-event-lite-plugin-1-1-unauthenticated-non-arbitrary-local-file-inclusion-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-98" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-94h8-v4v7-2hf5/GHSA-94h8-v4v7-2hf5.json b/advisories/unreviewed/2025/01/GHSA-94h8-v4v7-2hf5/GHSA-94h8-v4v7-2hf5.json new file mode 100644 index 00000000000..b71433dc311 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-94h8-v4v7-2hf5/GHSA-94h8-v4v7-2hf5.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-94h8-v4v7-2hf5", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22561" + ], + "details": "Missing Authorization vulnerability in Jason Funk Title Experiments Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Title Experiments Free: from n/a through 9.0.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22561" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-experiments-free/vulnerability/wordpress-title-experiments-free-plugin-9-0-4-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-99gc-m78g-59j2/GHSA-99gc-m78g-59j2.json b/advisories/unreviewed/2025/01/GHSA-99gc-m78g-59j2/GHSA-99gc-m78g-59j2.json new file mode 100644 index 00000000000..2efe2c73683 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-99gc-m78g-59j2/GHSA-99gc-m78g-59j2.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-99gc-m78g-59j2", + "modified": "2025-01-09T18:32:15Z", + "published": "2025-01-09T18:32:15Z", + "aliases": [ + "CVE-2025-22824" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lucia Intelisano Live Flight Radar allows Stored XSS.This issue affects Live Flight Radar: from n/a through 1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22824" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/live-flight-radar/vulnerability/wordpress-live-flight-radar-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-9jq5-c3p6-m35x/GHSA-9jq5-c3p6-m35x.json b/advisories/unreviewed/2025/01/GHSA-9jq5-c3p6-m35x/GHSA-9jq5-c3p6-m35x.json new file mode 100644 index 00000000000..8fd688a0b41 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-9jq5-c3p6-m35x/GHSA-9jq5-c3p6-m35x.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9jq5-c3p6-m35x", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22801" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes Free WooCommerce Theme 99fy Extension allows Stored XSS.This issue affects Free WooCommerce Theme 99fy Extension: from n/a through 1.2.8.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22801" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/99fy-core/vulnerability/wordpress-free-woocommerce-theme-99fy-extension-plugin-1-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-c9h3-5qgq-g7wx/GHSA-c9h3-5qgq-g7wx.json b/advisories/unreviewed/2025/01/GHSA-c9h3-5qgq-g7wx/GHSA-c9h3-5qgq-g7wx.json index 56c69d8c6dc..0587c1be72f 100644 --- a/advisories/unreviewed/2025/01/GHSA-c9h3-5qgq-g7wx/GHSA-c9h3-5qgq-g7wx.json +++ b/advisories/unreviewed/2025/01/GHSA-c9h3-5qgq-g7wx/GHSA-c9h3-5qgq-g7wx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c9h3-5qgq-g7wx", - "modified": "2025-01-08T00:30:49Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-06T18:31:04Z", "aliases": [ "CVE-2024-56767" @@ -19,10 +19,18 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56767" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3d229600c54e9e0909080ecaf1aab0642aefa5f0" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/54376d8d26596f98ed7432a788314bb9154bf3e3" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8d364597de9ce2a5f52714224bfe6c2e7a29b303" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/c43ec96e8d34399bd9dab2f2dc316b904892133f" @@ -31,6 +39,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/e658f1c133b854b2ae799147301d82dddb8f3162" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ed1a8aaa344522c0c349ac9042db27ad130ef913" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/fdba6d5e455388377ec7e82a5913ddfcc7edd93b" diff --git a/advisories/unreviewed/2025/01/GHSA-cv7v-pm8v-8g6x/GHSA-cv7v-pm8v-8g6x.json b/advisories/unreviewed/2025/01/GHSA-cv7v-pm8v-8g6x/GHSA-cv7v-pm8v-8g6x.json new file mode 100644 index 00000000000..cc62e4de49e --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-cv7v-pm8v-8g6x/GHSA-cv7v-pm8v-8g6x.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cv7v-pm8v-8g6x", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22510" + ], + "details": "Deserialization of Untrusted Data vulnerability in Konrad Karpieszuk WC Price History for Omnibus allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through 2.1.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22510" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wc-price-history/vulnerability/wordpress-wc-price-history-for-omnibus-plugin-2-1-4-php-object-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-f6qv-3f59-g6g6/GHSA-f6qv-3f59-g6g6.json b/advisories/unreviewed/2025/01/GHSA-f6qv-3f59-g6g6/GHSA-f6qv-3f59-g6g6.json new file mode 100644 index 00000000000..3f0dfedad8a --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-f6qv-3f59-g6g6/GHSA-f6qv-3f59-g6g6.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f6qv-3f59-g6g6", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22815" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LLC Button Block allows Stored XSS.This issue affects Button Block: from n/a through 1.1.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22815" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/button-block/vulnerability/wordpress-button-block-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-f838-5wcc-83jr/GHSA-f838-5wcc-83jr.json b/advisories/unreviewed/2025/01/GHSA-f838-5wcc-83jr/GHSA-f838-5wcc-83jr.json new file mode 100644 index 00000000000..f2cba7c7ea8 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-f838-5wcc-83jr/GHSA-f838-5wcc-83jr.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f838-5wcc-83jr", + "modified": "2025-01-09T18:32:15Z", + "published": "2025-01-09T18:32:15Z", + "aliases": [ + "CVE-2025-22813" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ChatBot for WordPress - WPBot Conversational Forms for ChatBot allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through 1.4.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22813" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/conversational-forms/vulnerability/wordpress-chatbot-conversational-forms-plugin-1-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-fr8p-p78g-hq9f/GHSA-fr8p-p78g-hq9f.json b/advisories/unreviewed/2025/01/GHSA-fr8p-p78g-hq9f/GHSA-fr8p-p78g-hq9f.json new file mode 100644 index 00000000000..70b1a55d973 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-fr8p-p78g-hq9f/GHSA-fr8p-p78g-hq9f.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fr8p-p78g-hq9f", + "modified": "2025-01-09T18:32:13Z", + "published": "2025-01-09T18:32:13Z", + "aliases": [ + "CVE-2025-22331" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in P3JX Cf7Save Extension allows Reflected XSS.This issue affects Cf7Save Extension: from n/a through 1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22331" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/cf7save-extension/vulnerability/wordpress-cf7save-extension-plugin-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-frx6-qwhw-g358/GHSA-frx6-qwhw-g358.json b/advisories/unreviewed/2025/01/GHSA-frx6-qwhw-g358/GHSA-frx6-qwhw-g358.json index c5e5b5ea796..8965ccc30d1 100644 --- a/advisories/unreviewed/2025/01/GHSA-frx6-qwhw-g358/GHSA-frx6-qwhw-g358.json +++ b/advisories/unreviewed/2025/01/GHSA-frx6-qwhw-g358/GHSA-frx6-qwhw-g358.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-frx6-qwhw-g358", - "modified": "2025-01-07T21:30:55Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-07T18:30:49Z", "aliases": [ "CVE-2024-46602" @@ -19,6 +19,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46602" }, + { + "type": "WEB", + "url": "https://www.elspec-ltd.com/support/security-advisories." + }, { "type": "WEB", "url": "http://elspec.com" diff --git a/advisories/unreviewed/2025/01/GHSA-g8hm-rf76-vrh2/GHSA-g8hm-rf76-vrh2.json b/advisories/unreviewed/2025/01/GHSA-g8hm-rf76-vrh2/GHSA-g8hm-rf76-vrh2.json new file mode 100644 index 00000000000..0f00db36875 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-g8hm-rf76-vrh2/GHSA-g8hm-rf76-vrh2.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g8hm-rf76-vrh2", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22817" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra allows Stored XSS.This issue affects BP Profile Shortcodes Extra: from n/a through 2.6.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22817" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/bp-profile-shortcodes-extra/vulnerability/wordpress-bp-profile-shortcodes-extra-plugin-2-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-gq7r-crg9-j93x/GHSA-gq7r-crg9-j93x.json b/advisories/unreviewed/2025/01/GHSA-gq7r-crg9-j93x/GHSA-gq7r-crg9-j93x.json new file mode 100644 index 00000000000..257cacba9f8 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-gq7r-crg9-j93x/GHSA-gq7r-crg9-j93x.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gq7r-crg9-j93x", + "modified": "2025-01-09T18:32:15Z", + "published": "2025-01-09T18:32:15Z", + "aliases": [ + "CVE-2025-21592" + ], + "details": "An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of sensitive files on the file system.\n\nThrough the execution of either 'show services advanced-anti-malware' or 'show services security-intelligence' command, a user with limited permissions (e.g., a low privilege login class user) can access protected files that should not be accessible to the user. These files may contain sensitive information that can be used to cause further impact to the system.\n\n\nThis issue affects Junos OS SRX Series:\n\n\n\n * All versions before 21.4R3-S8,\n\n * from 22.2 before 22.2R3-S5,\n\n * from 22.3 before 22.3R3-S3,\n * from 22.4 before 22.4R3-S2,\n\n * from 23.2 before 23.2R2-S1,\n\n * from 23.4 before 23.4R2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21592" + }, + { + "type": "WEB", + "url": "https://supportportal.juniper.net/JSA92860" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T17:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-h2ph-46gg-pqc4/GHSA-h2ph-46gg-pqc4.json b/advisories/unreviewed/2025/01/GHSA-h2ph-46gg-pqc4/GHSA-h2ph-46gg-pqc4.json new file mode 100644 index 00000000000..9da92dd8ebf --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-h2ph-46gg-pqc4/GHSA-h2ph-46gg-pqc4.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h2ph-46gg-pqc4", + "modified": "2025-01-09T18:32:15Z", + "published": "2025-01-09T18:32:15Z", + "aliases": [ + "CVE-2025-22826" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpecommerce, wp.insider Sell Digital Downloads allows Stored XSS.This issue affects Sell Digital Downloads: from n/a through 2.2.7.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22826" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/sell-digital-downloads/vulnerability/wordpress-sell-digital-downloads-plugin-2-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-hww3-xc4f-4f2v/GHSA-hww3-xc4f-4f2v.json b/advisories/unreviewed/2025/01/GHSA-hww3-xc4f-4f2v/GHSA-hww3-xc4f-4f2v.json new file mode 100644 index 00000000000..35d0e7c6cf7 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-hww3-xc4f-4f2v/GHSA-hww3-xc4f-4f2v.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hww3-xc4f-4f2v", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22814" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through 1.4.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22814" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/zephyr-modern-admin-theme/vulnerability/wordpress-zephyr-admin-theme-plugin-1-4-1-csrf-to-stored-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-j77p-7hff-qw5r/GHSA-j77p-7hff-qw5r.json b/advisories/unreviewed/2025/01/GHSA-j77p-7hff-qw5r/GHSA-j77p-7hff-qw5r.json new file mode 100644 index 00000000000..b304a37bb2b --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-j77p-7hff-qw5r/GHSA-j77p-7hff-qw5r.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j77p-7hff-qw5r", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22527" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yamna Khawaja Mailing Group Listserv allows SQL Injection.This issue affects Mailing Group Listserv: from n/a through 2.0.9.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22527" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-mailing-group/vulnerability/wordpress-mailing-group-listserv-plugin-2-0-9-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-mg98-ghp4-fx34/GHSA-mg98-ghp4-fx34.json b/advisories/unreviewed/2025/01/GHSA-mg98-ghp4-fx34/GHSA-mg98-ghp4-fx34.json new file mode 100644 index 00000000000..6f4c26043c5 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-mg98-ghp4-fx34/GHSA-mg98-ghp4-fx34.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mg98-ghp4-fx34", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22539" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ka2 Custom DataBase Tables allows Reflected XSS.This issue affects Custom DataBase Tables: from n/a through 2.1.34.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22539" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/custom-database-tables/vulnerability/wordpress-custom-database-tables-plugin-2-1-34-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-p34f-rw7f-c723/GHSA-p34f-rw7f-c723.json b/advisories/unreviewed/2025/01/GHSA-p34f-rw7f-c723/GHSA-p34f-rw7f-c723.json new file mode 100644 index 00000000000..deddf8c582b --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-p34f-rw7f-c723/GHSA-p34f-rw7f-c723.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p34f-rw7f-c723", + "modified": "2025-01-09T18:32:15Z", + "published": "2025-01-09T18:32:15Z", + "aliases": [ + "CVE-2025-21599" + ], + "details": "A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Tunnel Driver (jtd) of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to cause Denial of Service. \n\nReceipt of specifically malformed IPv6 packets, destined to the device, causes kernel memory to not be freed, resulting in memory exhaustion leading to a system crash and Denial of Service (DoS). Continuous receipt and processing of these packets will continue to exhaust kernel memory, creating a sustained Denial of Service (DoS) condition.\nThis issue only affects systems configured with IPv6.\n\nThis issue affects Junos OS Evolved: \n\n\n\n * from 22.4-EVO before 22.4R3-S5-EVO, \n * from 23.2-EVO before 23.2R2-S2-EVO, \n * from 23.4-EVO before 23.4R2-S2-EVO, \n * from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.\n\n\n\n\nThis issue does not affect Juniper Networks Junos OS Evolved versions prior to 22.4R1-EVO.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21599" + }, + { + "type": "WEB", + "url": "https://supportportal.juniper.net/JSA92869" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-401" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T17:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-p52f-fg64-jqxw/GHSA-p52f-fg64-jqxw.json b/advisories/unreviewed/2025/01/GHSA-p52f-fg64-jqxw/GHSA-p52f-fg64-jqxw.json new file mode 100644 index 00000000000..42aa50f9871 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-p52f-fg64-jqxw/GHSA-p52f-fg64-jqxw.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p52f-fg64-jqxw", + "modified": "2025-01-09T18:32:15Z", + "published": "2025-01-09T18:32:15Z", + "aliases": [ + "CVE-2025-21600" + ], + "details": "An Out-of-Bounds Read vulnerability in\n\nthe routing protocol daemon (rpd) of \n\n Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\n\n\n\nThis issue only affects systems configured in\n either of two ways:\n\n \n \n * systems with BGP traceoptions enabled\n\n * systems with BGP family traffic-engineering (BGP-LS)\n configured\n\n\n and can be exploited from a directly connected and configured BGP peer. \n\nThis issue affects iBGP and eBGP \n\nwith \n\nany address family\n\n configured, and both IPv4 and IPv6 are affected by this vulnerability.\n\nThis issue affects:\n\nJunos OS: \n\n\n\n * All versions before 21.4R3-S9, \n * from 22.2 before 22.2R3-S5, \n * from 22.3 before 22.3R3-S4, \n * from 22.4 before 22.4R3-S5, \n * from 23.2 before 23.2R2-S3, \n * from 23.4 before 23.4R2-S3, \n * from 24.2 before 24.2R1-S2, 24.2R2; \n\n\n\n\nJunos OS Evolved: \n\n\n\n * All versions before 21.4R3-S9-EVO, \n * from 22.2 before 22.2R3-S5-EVO, \n * from 22.3 before 22.3R3-S4-EVO, \n * from 22.4 before 22.4R3-S5-EVO, \n * from 23.2 before 23.2R2-S3-EVO, \n * from 23.4 before 23.4R2-S2-EVO, \n * from 24.2 before 24.2R1-S2-EVO, 24.2R2-EVO.\n\n\n\nThis is a similar, but different vulnerability than the issue reported as CVE-2024-39516.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:C/RE:M/U:Green" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21600" + }, + { + "type": "WEB", + "url": "https://supportportal.juniper.net/JSA92870" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T17:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-ph2q-q44w-285x/GHSA-ph2q-q44w-285x.json b/advisories/unreviewed/2025/01/GHSA-ph2q-q44w-285x/GHSA-ph2q-q44w-285x.json new file mode 100644 index 00000000000..2539347f171 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-ph2q-q44w-285x/GHSA-ph2q-q44w-285x.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ph2q-q44w-285x", + "modified": "2025-01-09T18:32:15Z", + "published": "2025-01-09T18:32:15Z", + "aliases": [ + "CVE-2025-22822" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bishawjit Das wp custom countdown allows Stored XSS.This issue affects wp custom countdown: from n/a through 2.8.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22822" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-custom-countdown/vulnerability/wordpress-wp-custom-countdown-plugin-2-8-stored-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-pxhx-qjw6-jg43/GHSA-pxhx-qjw6-jg43.json b/advisories/unreviewed/2025/01/GHSA-pxhx-qjw6-jg43/GHSA-pxhx-qjw6-jg43.json new file mode 100644 index 00000000000..595bfa2e396 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-pxhx-qjw6-jg43/GHSA-pxhx-qjw6-jg43.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pxhx-qjw6-jg43", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22808" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Surbma Surbma | Premium WP allows DOM-Based XSS.This issue affects Surbma | Premium WP: from n/a through 9.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22808" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/surbma-premium-wp/vulnerability/wordpress-surbma-premium-wp-plugin-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-q23h-j65c-73m4/GHSA-q23h-j65c-73m4.json b/advisories/unreviewed/2025/01/GHSA-q23h-j65c-73m4/GHSA-q23h-j65c-73m4.json index ebdae7ec0f7..d2e1a9bd074 100644 --- a/advisories/unreviewed/2025/01/GHSA-q23h-j65c-73m4/GHSA-q23h-j65c-73m4.json +++ b/advisories/unreviewed/2025/01/GHSA-q23h-j65c-73m4/GHSA-q23h-j65c-73m4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-q23h-j65c-73m4", - "modified": "2025-01-08T00:30:49Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-06T18:31:04Z", "aliases": [ "CVE-2024-56769" @@ -19,6 +19,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56769" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/035772fcd631eee2756b31cb6df249c0a8d453d7" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/1d6de21f00293d819b5ca6dbe75ff1f3b6392140" @@ -31,9 +35,17 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/3876e3a1c31a58a352c6bf5d2a90e3304445a637" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/53106510736e734ce8b731ba871363389bfbf4c9" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/c1197c1457bb7098cf46366e898eb52b41b6876a" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e11778189513cd7fb2edced5bd053bc18ede8418" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/01/GHSA-q66h-qcgx-8rcf/GHSA-q66h-qcgx-8rcf.json b/advisories/unreviewed/2025/01/GHSA-q66h-qcgx-8rcf/GHSA-q66h-qcgx-8rcf.json new file mode 100644 index 00000000000..73f623f94b4 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-q66h-qcgx-8rcf/GHSA-q66h-qcgx-8rcf.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q66h-qcgx-8rcf", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22802" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: from n/a through 2.1.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22802" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/yeemail/vulnerability/wordpress-email-templates-customizer-yeemail-plugin-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-q9hp-vwf8-w58f/GHSA-q9hp-vwf8-w58f.json b/advisories/unreviewed/2025/01/GHSA-q9hp-vwf8-w58f/GHSA-q9hp-vwf8-w58f.json index 49d40ffd810..1ca2e3fe331 100644 --- a/advisories/unreviewed/2025/01/GHSA-q9hp-vwf8-w58f/GHSA-q9hp-vwf8-w58f.json +++ b/advisories/unreviewed/2025/01/GHSA-q9hp-vwf8-w58f/GHSA-q9hp-vwf8-w58f.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-q9hp-vwf8-w58f", - "modified": "2025-01-08T00:30:49Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-06T18:31:04Z", "aliases": [ "CVE-2024-56761" @@ -19,6 +19,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56761" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/151447859d6fb0dcce8259f0971c6e94fb801661" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/b939f108e86b76119428a6fa4e92491e09ac7867" diff --git a/advisories/unreviewed/2025/01/GHSA-r2cp-qxjw-69v8/GHSA-r2cp-qxjw-69v8.json b/advisories/unreviewed/2025/01/GHSA-r2cp-qxjw-69v8/GHSA-r2cp-qxjw-69v8.json index 3187dd1c461..29629d50500 100644 --- a/advisories/unreviewed/2025/01/GHSA-r2cp-qxjw-69v8/GHSA-r2cp-qxjw-69v8.json +++ b/advisories/unreviewed/2025/01/GHSA-r2cp-qxjw-69v8/GHSA-r2cp-qxjw-69v8.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-r2cp-qxjw-69v8", - "modified": "2025-01-09T09:31:41Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-09T09:31:41Z", "aliases": [ "CVE-2024-53706" ], "details": "A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-privileged attacker to elevate privileges to `root` and potentially lead to code execution.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-269" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-09T07:15:27Z" diff --git a/advisories/unreviewed/2025/01/GHSA-r524-c5c7-wf87/GHSA-r524-c5c7-wf87.json b/advisories/unreviewed/2025/01/GHSA-r524-c5c7-wf87/GHSA-r524-c5c7-wf87.json new file mode 100644 index 00000000000..44301bc6209 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-r524-c5c7-wf87/GHSA-r524-c5c7-wf87.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r524-c5c7-wf87", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22812" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlickDevs News Ticker Widget for Elementor allows Stored XSS.This issue affects News Ticker Widget for Elementor: from n/a through 1.3.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22812" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/news-ticker-widget-for-elementor/vulnerability/wordpress-news-ticker-widget-for-elementor-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-r873-vq83-q529/GHSA-r873-vq83-q529.json b/advisories/unreviewed/2025/01/GHSA-r873-vq83-q529/GHSA-r873-vq83-q529.json new file mode 100644 index 00000000000..66b8696cc06 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-r873-vq83-q529/GHSA-r873-vq83-q529.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r873-vq83-q529", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22805" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePoints Skill Bar allows Stored XSS.This issue affects Skill Bar: from n/a through 1.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22805" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/skillbars/vulnerability/wordpress-skill-bar-plugin-1-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-rchw-848j-99vq/GHSA-rchw-848j-99vq.json b/advisories/unreviewed/2025/01/GHSA-rchw-848j-99vq/GHSA-rchw-848j-99vq.json new file mode 100644 index 00000000000..2a1088be6b2 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-rchw-848j-99vq/GHSA-rchw-848j-99vq.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rchw-848j-99vq", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22542" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ofek Nakar Virtual Bot allows Blind SQL Injection.This issue affects Virtual Bot: from n/a through 1.0.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22542" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/virtual-bot/vulnerability/wordpress-virtual-bot-plugin-1-0-0-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-rv32-jqvp-4638/GHSA-rv32-jqvp-4638.json b/advisories/unreviewed/2025/01/GHSA-rv32-jqvp-4638/GHSA-rv32-jqvp-4638.json new file mode 100644 index 00000000000..8f523e18cd2 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-rv32-jqvp-4638/GHSA-rv32-jqvp-4638.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rv32-jqvp-4638", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22540" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sebastian Orellana Emailing Subscription allows Blind SQL Injection.This issue affects Emailing Subscription: from n/a through 1.4.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22540" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/email-suscripcion/vulnerability/wordpress-emailing-subscription-plugin-1-4-1-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-rxq5-5w2f-g92r/GHSA-rxq5-5w2f-g92r.json b/advisories/unreviewed/2025/01/GHSA-rxq5-5w2f-g92r/GHSA-rxq5-5w2f-g92r.json new file mode 100644 index 00000000000..fe3827ca283 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-rxq5-5w2f-g92r/GHSA-rxq5-5w2f-g92r.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rxq5-5w2f-g92r", + "modified": "2025-01-09T18:32:15Z", + "published": "2025-01-09T18:32:15Z", + "aliases": [ + "CVE-2025-21596" + ], + "details": "An Improper Handling of Exceptional Conditions vulnerability in the command-line processing of Juniper Networks Junos OS on SRX1500, SRX4100, and SRX4200 devices allows a local, low-privileged authenticated attacker executing the 'show chassis environment pem' command to cause the chassis daemon (chassisd) to crash and restart, resulting in a temporary Denial of Service (DoS). However, repeated execution of this command will eventually cause the chassisd process to fail to restart, impacting packet processing on the system.\n\nThis issue affects Junos OS on SRX1500, SRX4100, SRX4200: \n\n\n\n * All versions before 21.4R3-S9, \n * from 22.2 before 22.2R3-S5, \n * from 22.3 before 22.3R3-S4, \n * from 22.4 before 22.4R3-S4, \n * from 23.2 before 23.2R2-S3, \n * from 23.4 before 23.4R2-S1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:M/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21596" + }, + { + "type": "WEB", + "url": "https://supportportal.juniper.net/JSA92864" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-755" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T17:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-v6vj-g86q-2vm8/GHSA-v6vj-g86q-2vm8.json b/advisories/unreviewed/2025/01/GHSA-v6vj-g86q-2vm8/GHSA-v6vj-g86q-2vm8.json new file mode 100644 index 00000000000..3b5c22668d9 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-v6vj-g86q-2vm8/GHSA-v6vj-g86q-2vm8.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v6vj-g86q-2vm8", + "modified": "2025-01-09T18:32:15Z", + "published": "2025-01-09T18:32:15Z", + "aliases": [ + "CVE-2025-22827" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joomag. WP Joomag allows DOM-Based XSS.This issue affects WP Joomag: from n/a through 2.5.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22827" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-joomag/vulnerability/wordpress-wp-joomag-plugin-2-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-v85m-7mw4-4363/GHSA-v85m-7mw4-4363.json b/advisories/unreviewed/2025/01/GHSA-v85m-7mw4-4363/GHSA-v85m-7mw4-4363.json new file mode 100644 index 00000000000..f269eeefe35 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-v85m-7mw4-4363/GHSA-v85m-7mw4-4363.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v85m-7mw4-4363", + "modified": "2025-01-09T18:32:15Z", + "published": "2025-01-09T18:32:15Z", + "aliases": [ + "CVE-2025-21602" + ], + "details": "An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a specific BGP update packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). \n\nContinuous receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\n\nThis issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.\n\nThis issue affects Junos OS: \n\n\n\n * from 21.4 before 21.4R3-S9, \n * from 22.2 before 22.2R3-S5, \n * from 22.3 before 22.3R3-S4,\n * from 22.4 before 22.4R3-S5, \n * from 23.2 before 23.2R2-S3, \n * from 23.4 before 23.4R2-S3, \n * from 24.2 before 24.2R1-S2, 24.2R2; \n\n\nThis issue does not affect versions prior to 21.1R1.\n\n\n\n\n\nJunos OS Evolved: \n\n\n\n * from 21.4 before 21.4R3-S9-EVO, \n * from 22.2 before 22.2R3-S5-EVO, \n * from 22.3 before 22.3R3-S4-EVO,\n * from 22.4 before 22.4R3-S5-EVO, \n * from 23.2 before 23.2R2-S3-EVO, \n * from 23.4 before 23.4R2-S3-EVO, \n * from 24.2 before 24.2R1-S2-EVO, 24.2R2-EVO.\n\n\nThis issue does not affect versions prior to 21.1R1-EVO", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:C/RE:M/U:Green" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21602" + }, + { + "type": "WEB", + "url": "https://supportportal.juniper.net/JSA92872" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-755" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T17:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-vgr6-rw4j-x24g/GHSA-vgr6-rw4j-x24g.json b/advisories/unreviewed/2025/01/GHSA-vgr6-rw4j-x24g/GHSA-vgr6-rw4j-x24g.json index 9f5b5d83af1..228919c4028 100644 --- a/advisories/unreviewed/2025/01/GHSA-vgr6-rw4j-x24g/GHSA-vgr6-rw4j-x24g.json +++ b/advisories/unreviewed/2025/01/GHSA-vgr6-rw4j-x24g/GHSA-vgr6-rw4j-x24g.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-vgr6-rw4j-x24g", - "modified": "2025-01-09T06:30:24Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-09T06:30:24Z", "aliases": [ "CVE-2024-12736" ], "details": "The BU Section Editing WordPress plugin through 0.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -21,7 +26,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-09T06:15:15Z" diff --git a/advisories/unreviewed/2025/01/GHSA-vgvf-f85f-78qf/GHSA-vgvf-f85f-78qf.json b/advisories/unreviewed/2025/01/GHSA-vgvf-f85f-78qf/GHSA-vgvf-f85f-78qf.json index 0df511aae9b..2729444cf02 100644 --- a/advisories/unreviewed/2025/01/GHSA-vgvf-f85f-78qf/GHSA-vgvf-f85f-78qf.json +++ b/advisories/unreviewed/2025/01/GHSA-vgvf-f85f-78qf/GHSA-vgvf-f85f-78qf.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-vgvf-f85f-78qf", - "modified": "2025-01-09T06:30:24Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-09T06:30:23Z", "aliases": [ "CVE-2024-12715" ], "details": "The Asgard Security Scanner WordPress plugin through 0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-09T06:15:14Z" diff --git a/advisories/unreviewed/2025/01/GHSA-vj55-2cxj-5mrc/GHSA-vj55-2cxj-5mrc.json b/advisories/unreviewed/2025/01/GHSA-vj55-2cxj-5mrc/GHSA-vj55-2cxj-5mrc.json index 970e8a67749..889e94f349a 100644 --- a/advisories/unreviewed/2025/01/GHSA-vj55-2cxj-5mrc/GHSA-vj55-2cxj-5mrc.json +++ b/advisories/unreviewed/2025/01/GHSA-vj55-2cxj-5mrc/GHSA-vj55-2cxj-5mrc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vj55-2cxj-5mrc", - "modified": "2025-01-08T00:30:49Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-06T18:31:04Z", "aliases": [ "CVE-2024-56763" @@ -27,6 +27,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/1cca920af19df5dd91254e5ff35e68e911683706" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2558d753df0628d4187d8e1fd989339460f4f364" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/3d15f4c2449558ffe83b4dba30614ef1cd6937c3" @@ -34,6 +38,10 @@ { "type": "WEB", "url": "https://git.kernel.org/stable/c/98feccbf32cfdde8c722bc4587aaa60ee5ac33f0" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f60172b447317cb6c5e74b5601a151866269baf6" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/01/GHSA-vrfp-847g-6qw9/GHSA-vrfp-847g-6qw9.json b/advisories/unreviewed/2025/01/GHSA-vrfp-847g-6qw9/GHSA-vrfp-847g-6qw9.json new file mode 100644 index 00000000000..4f2047f47fa --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-vrfp-847g-6qw9/GHSA-vrfp-847g-6qw9.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vrfp-847g-6qw9", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22811" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modeltheme MT Addons for Elementor allows Stored XSS.This issue affects MT Addons for Elementor: from n/a through 1.0.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22811" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/mt-addons-for-elementor/vulnerability/wordpress-mt-addons-for-elementor-plugin-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-w3jp-95q8-wv48/GHSA-w3jp-95q8-wv48.json b/advisories/unreviewed/2025/01/GHSA-w3jp-95q8-wv48/GHSA-w3jp-95q8-wv48.json index d8bacfa379a..73d92435984 100644 --- a/advisories/unreviewed/2025/01/GHSA-w3jp-95q8-wv48/GHSA-w3jp-95q8-wv48.json +++ b/advisories/unreviewed/2025/01/GHSA-w3jp-95q8-wv48/GHSA-w3jp-95q8-wv48.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-w3jp-95q8-wv48", - "modified": "2025-01-08T18:30:48Z", + "modified": "2025-01-09T18:32:13Z", "published": "2025-01-07T21:30:55Z", "aliases": [ "CVE-2024-53522" @@ -30,6 +30,10 @@ { "type": "WEB", "url": "http://hosxp.com" + }, + { + "type": "WEB", + "url": "http://hosxp.net" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/01/GHSA-wrc6-jvcr-2g5p/GHSA-wrc6-jvcr-2g5p.json b/advisories/unreviewed/2025/01/GHSA-wrc6-jvcr-2g5p/GHSA-wrc6-jvcr-2g5p.json new file mode 100644 index 00000000000..27d186106b9 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-wrc6-jvcr-2g5p/GHSA-wrc6-jvcr-2g5p.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wrc6-jvcr-2g5p", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22809" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gravity Master PDF Catalog Woocommerce allows DOM-Based XSS.This issue affects PDF Catalog Woocommerce: from n/a through 2.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22809" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/pdf-catalog-woocommerce/vulnerability/wordpress-pdf-catalog-woocommerce-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-xmmp-pp2j-r7jm/GHSA-xmmp-pp2j-r7jm.json b/advisories/unreviewed/2025/01/GHSA-xmmp-pp2j-r7jm/GHSA-xmmp-pp2j-r7jm.json new file mode 100644 index 00000000000..3a588e30335 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-xmmp-pp2j-r7jm/GHSA-xmmp-pp2j-r7jm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xmmp-pp2j-r7jm", + "modified": "2025-01-09T18:32:14Z", + "published": "2025-01-09T18:32:14Z", + "aliases": [ + "CVE-2025-22504" + ], + "details": "Unrestricted Upload of File with Dangerous Type vulnerability in jumpdemand 4ECPS Web Forms allows Upload a Web Shell to a Web Server.This issue affects 4ECPS Web Forms: from n/a through 0.2.18.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22504" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/4ecps-webforms/vulnerability/wordpress-4ecps-web-forms-plugin-0-2-18-arbitrary-file-upload-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-xwj6-f3wq-283g/GHSA-xwj6-f3wq-283g.json b/advisories/unreviewed/2025/01/GHSA-xwj6-f3wq-283g/GHSA-xwj6-f3wq-283g.json new file mode 100644 index 00000000000..179060a252a --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-xwj6-f3wq-283g/GHSA-xwj6-f3wq-283g.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xwj6-f3wq-283g", + "modified": "2025-01-09T18:32:15Z", + "published": "2025-01-09T18:32:15Z", + "aliases": [ + "CVE-2025-22823" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Twerdy Genesis Style Shortcodes allows DOM-Based XSS.This issue affects Genesis Style Shortcodes: from n/a through 1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22823" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/genesis-style-shortcodes/vulnerability/wordpress-genesis-style-shortcodes-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-09T16:16:32Z" + } +} \ No newline at end of file