Publish Advisories

GHSA-25fr-9mxc-qjvr GHSA-2f5r-p45g-vr7g GHSA-2f9p-v3x6-jqrm GHSA-8jx3-cx25-4j8f
2026-05-22 18:04:22 -07:00 · 2025-02-16 15:31:59 +00:00
parent a26f486a2c
commit 804c11cdd4
4 changed files with 220 additions and 0 deletions
@@ -0,0 +1,64 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-25fr-9mxc-qjvr",
+  "modified": "2025-02-16T15:30:49Z",
+  "published": "2025-02-16T15:30:49Z",
+  "aliases": [
+    "CVE-2025-1352"
+  ],
+  "details": "A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1352"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sourceware.org/bugzilla/attachment.cgi?id=15923"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32650"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32650#c2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.295960"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.295960"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.495965"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.gnu.org"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-119"
+    ],
+    "severity": "LOW",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-16T15:15:09Z"
+  }
+}
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2f5r-p45g-vr7g",
+  "modified": "2025-02-16T15:30:49Z",
+  "published": "2025-02-16T15:30:49Z",
+  "aliases": [
+    "CVE-2025-1340"
+  ],
+  "details": "A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1340"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/stevenchen0x01/CVE2/blob/main/stack_overflow.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.295956"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.295956"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.495368"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.totolink.net"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-119"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-16T14:15:21Z"
+  }
+}
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2f9p-v3x6-jqrm",
+  "modified": "2025-02-16T15:30:49Z",
+  "published": "2025-02-16T15:30:49Z",
+  "aliases": [
+    "CVE-2025-1341"
+  ],
+  "details": "A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0. This affects an unknown part of the component Setting Handler. The manipulation leads to weak password requirements. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1341"
+    },
+    {
+      "type": "WEB",
+      "url": "https://mega.nz/file/yY0BnAgK#08RcRH8c8D4zMhKLEqQwMenHV65lnHsOSuV4eQkdcxY"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.295959"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.295959"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.495635"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-521"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-16T14:15:21Z"
+  }
+}
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8jx3-cx25-4j8f",
+  "modified": "2025-02-16T15:30:49Z",
+  "published": "2025-02-16T15:30:49Z",
+  "aliases": [
+    "CVE-2025-1353"
+  ],
+  "details": "A vulnerability was found in Kong Insomnia up to 10.3.0 and classified as critical. This issue affects some unknown processing in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1353"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.295961"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.295961"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.496010"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-426"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-16T15:15:09Z"
+  }
+}