From 80b720597edce473a2fc7e3d9dfc733bfce12e4e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 28 Mar 2025 00:32:53 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-qq9f-q439-2574.json | 10 +++- .../GHSA-9hcj-pv58-28wg.json | 11 ++-- .../GHSA-mjrx-2vvf-h6ww.json | 4 +- .../GHSA-cwg9-5f2g-87h2.json | 11 ++-- .../GHSA-pm93-x7pc-g8qx.json | 4 +- .../GHSA-5mg2-h7qv-m552.json | 11 ++-- .../GHSA-8xc6-54p8-3p65.json | 15 ++++-- .../GHSA-cq2v-6q97-jv69.json | 15 ++++-- .../GHSA-rm2h-rx39-6fc3.json | 15 ++++-- .../GHSA-q3rr-g46f-jgqr.json | 6 ++- .../GHSA-32xp-gg7c-5hwm.json | 36 +++++++++++++ .../GHSA-33fg-76g4-jv5r.json | 36 +++++++++++++ .../GHSA-3wrq-rm5m-mgw2.json | 36 +++++++++++++ .../GHSA-48q4-2p6c-rxg9.json | 36 +++++++++++++ .../GHSA-4p9h-w8fh-6cjm.json | 36 +++++++++++++ .../GHSA-6638-q8q5-j5h6.json | 36 +++++++++++++ .../GHSA-7x38-336c-qcwr.json | 52 +++++++++++++++++++ .../GHSA-858x-f5c5-vm84.json | 36 +++++++++++++ .../GHSA-8w5m-q4c7-vwgq.json | 36 +++++++++++++ .../GHSA-8w8q-78fg-h887.json | 36 +++++++++++++ .../GHSA-gw2w-6qgf-9h98.json | 36 +++++++++++++ .../GHSA-hgg5-pp3m-2v92.json | 36 +++++++++++++ .../GHSA-jfqh-c88v-ccr7.json | 29 +++++++++++ .../GHSA-qw8f-786p-mp4v.json | 36 +++++++++++++ .../GHSA-r6gw-8vw8-65gm.json | 3 +- 25 files changed, 592 insertions(+), 26 deletions(-) create mode 100644 advisories/unreviewed/2025/03/GHSA-32xp-gg7c-5hwm/GHSA-32xp-gg7c-5hwm.json create mode 100644 advisories/unreviewed/2025/03/GHSA-33fg-76g4-jv5r/GHSA-33fg-76g4-jv5r.json create mode 100644 advisories/unreviewed/2025/03/GHSA-3wrq-rm5m-mgw2/GHSA-3wrq-rm5m-mgw2.json create mode 100644 advisories/unreviewed/2025/03/GHSA-48q4-2p6c-rxg9/GHSA-48q4-2p6c-rxg9.json create mode 100644 advisories/unreviewed/2025/03/GHSA-4p9h-w8fh-6cjm/GHSA-4p9h-w8fh-6cjm.json create mode 100644 advisories/unreviewed/2025/03/GHSA-6638-q8q5-j5h6/GHSA-6638-q8q5-j5h6.json create mode 100644 advisories/unreviewed/2025/03/GHSA-7x38-336c-qcwr/GHSA-7x38-336c-qcwr.json create mode 100644 advisories/unreviewed/2025/03/GHSA-858x-f5c5-vm84/GHSA-858x-f5c5-vm84.json create mode 100644 advisories/unreviewed/2025/03/GHSA-8w5m-q4c7-vwgq/GHSA-8w5m-q4c7-vwgq.json create mode 100644 advisories/unreviewed/2025/03/GHSA-8w8q-78fg-h887/GHSA-8w8q-78fg-h887.json create mode 100644 advisories/unreviewed/2025/03/GHSA-gw2w-6qgf-9h98/GHSA-gw2w-6qgf-9h98.json create mode 100644 advisories/unreviewed/2025/03/GHSA-hgg5-pp3m-2v92/GHSA-hgg5-pp3m-2v92.json create mode 100644 advisories/unreviewed/2025/03/GHSA-jfqh-c88v-ccr7/GHSA-jfqh-c88v-ccr7.json create mode 100644 advisories/unreviewed/2025/03/GHSA-qw8f-786p-mp4v/GHSA-qw8f-786p-mp4v.json diff --git a/advisories/github-reviewed/2025/01/GHSA-qq9f-q439-2574/GHSA-qq9f-q439-2574.json b/advisories/github-reviewed/2025/01/GHSA-qq9f-q439-2574/GHSA-qq9f-q439-2574.json index a8fd0f57ec8..2891707afe2 100644 --- a/advisories/github-reviewed/2025/01/GHSA-qq9f-q439-2574/GHSA-qq9f-q439-2574.json +++ b/advisories/github-reviewed/2025/01/GHSA-qq9f-q439-2574/GHSA-qq9f-q439-2574.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qq9f-q439-2574", - "modified": "2025-01-02T22:05:33Z", + "modified": "2025-03-28T00:31:28Z", "published": "2025-01-02T21:31:42Z", "aliases": [ "CVE-2024-8447" @@ -48,6 +48,14 @@ "type": "WEB", "url": "https://github.com/jbosstm/narayana/commit/eb778412de230afc4687a2df43641280494156c5" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:3357" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:3358" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-8447" diff --git a/advisories/unreviewed/2024/02/GHSA-9hcj-pv58-28wg/GHSA-9hcj-pv58-28wg.json b/advisories/unreviewed/2024/02/GHSA-9hcj-pv58-28wg/GHSA-9hcj-pv58-28wg.json index 5439192a4ed..fa5126fdb00 100644 --- a/advisories/unreviewed/2024/02/GHSA-9hcj-pv58-28wg/GHSA-9hcj-pv58-28wg.json +++ b/advisories/unreviewed/2024/02/GHSA-9hcj-pv58-28wg/GHSA-9hcj-pv58-28wg.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-9hcj-pv58-28wg", - "modified": "2024-02-29T00:30:22Z", + "modified": "2025-03-28T00:31:27Z", "published": "2024-02-29T00:30:22Z", "aliases": [ "CVE-2024-22983" ], "details": "SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], "affected": [], "references": [ { @@ -31,7 +36,7 @@ "cwe_ids": [ "CWE-89" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T22:15:26Z" diff --git a/advisories/unreviewed/2024/02/GHSA-mjrx-2vvf-h6ww/GHSA-mjrx-2vvf-h6ww.json b/advisories/unreviewed/2024/02/GHSA-mjrx-2vvf-h6ww/GHSA-mjrx-2vvf-h6ww.json index 76dd35e1c37..e35cda3ba30 100644 --- a/advisories/unreviewed/2024/02/GHSA-mjrx-2vvf-h6ww/GHSA-mjrx-2vvf-h6ww.json +++ b/advisories/unreviewed/2024/02/GHSA-mjrx-2vvf-h6ww/GHSA-mjrx-2vvf-h6ww.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-200" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/03/GHSA-cwg9-5f2g-87h2/GHSA-cwg9-5f2g-87h2.json b/advisories/unreviewed/2024/03/GHSA-cwg9-5f2g-87h2/GHSA-cwg9-5f2g-87h2.json index 338d291e621..a25e64a7dad 100644 --- a/advisories/unreviewed/2024/03/GHSA-cwg9-5f2g-87h2/GHSA-cwg9-5f2g-87h2.json +++ b/advisories/unreviewed/2024/03/GHSA-cwg9-5f2g-87h2/GHSA-cwg9-5f2g-87h2.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-cwg9-5f2g-87h2", - "modified": "2024-03-18T18:32:18Z", + "modified": "2025-03-28T00:31:27Z", "published": "2024-03-18T18:32:18Z", "aliases": [ "CVE-2024-1658" ], "details": "The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -21,7 +26,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-18T16:15:07Z" diff --git a/advisories/unreviewed/2024/03/GHSA-pm93-x7pc-g8qx/GHSA-pm93-x7pc-g8qx.json b/advisories/unreviewed/2024/03/GHSA-pm93-x7pc-g8qx/GHSA-pm93-x7pc-g8qx.json index ac16de9a018..e8e83b38fcd 100644 --- a/advisories/unreviewed/2024/03/GHSA-pm93-x7pc-g8qx/GHSA-pm93-x7pc-g8qx.json +++ b/advisories/unreviewed/2024/03/GHSA-pm93-x7pc-g8qx/GHSA-pm93-x7pc-g8qx.json @@ -57,7 +57,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-119" + ], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-5mg2-h7qv-m552/GHSA-5mg2-h7qv-m552.json b/advisories/unreviewed/2024/04/GHSA-5mg2-h7qv-m552/GHSA-5mg2-h7qv-m552.json index 05f9dacb137..4aca737682b 100644 --- a/advisories/unreviewed/2024/04/GHSA-5mg2-h7qv-m552/GHSA-5mg2-h7qv-m552.json +++ b/advisories/unreviewed/2024/04/GHSA-5mg2-h7qv-m552/GHSA-5mg2-h7qv-m552.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-5mg2-h7qv-m552", - "modified": "2024-06-25T21:31:12Z", + "modified": "2025-03-28T00:31:28Z", "published": "2024-04-05T09:30:39Z", "aliases": [ "CVE-2024-27437" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Disable auto-enable of exclusive INTx IRQ\n\nCurrently for devices requiring masking at the irqchip for INTx, ie.\ndevices without DisINTx support, the IRQ is enabled in request_irq()\nand subsequently disabled as necessary to align with the masked status\nflag. This presents a window where the interrupt could fire between\nthese events, resulting in the IRQ incrementing the disable depth twice.\nThis would be unrecoverable for a user since the masked flag prevents\nnested enables through vfio.\n\nInstead, invert the logic using IRQF_NO_AUTOEN such that exclusive INTx\nis never auto-enabled, then unmask as required.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -53,7 +58,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-05T09:15:09Z" diff --git a/advisories/unreviewed/2024/04/GHSA-8xc6-54p8-3p65/GHSA-8xc6-54p8-3p65.json b/advisories/unreviewed/2024/04/GHSA-8xc6-54p8-3p65/GHSA-8xc6-54p8-3p65.json index 6d8de96e562..701a90eb584 100644 --- a/advisories/unreviewed/2024/04/GHSA-8xc6-54p8-3p65/GHSA-8xc6-54p8-3p65.json +++ b/advisories/unreviewed/2024/04/GHSA-8xc6-54p8-3p65/GHSA-8xc6-54p8-3p65.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-8xc6-54p8-3p65", - "modified": "2024-04-04T09:30:36Z", + "modified": "2025-03-28T00:31:27Z", "published": "2024-04-04T09:30:36Z", "aliases": [ "CVE-2024-26807" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: cadence-qspi: fix pointer reference in runtime PM hooks\n\ndev_get_drvdata() gets used to acquire the pointer to cqspi and the SPI\ncontroller. Neither embed the other; this lead to memory corruption.\n\nOn a given platform (Mobileye EyeQ5) the memory corruption is hidden\ninside cqspi->f_pdata. Also, this uninitialised memory is used as a\nmutex (ctlr->bus_lock_mutex) by spi_controller_suspend().", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -28,8 +33,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-787" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-04T09:15:09Z" diff --git a/advisories/unreviewed/2024/04/GHSA-cq2v-6q97-jv69/GHSA-cq2v-6q97-jv69.json b/advisories/unreviewed/2024/04/GHSA-cq2v-6q97-jv69/GHSA-cq2v-6q97-jv69.json index 6024c502035..ec5dc28074a 100644 --- a/advisories/unreviewed/2024/04/GHSA-cq2v-6q97-jv69/GHSA-cq2v-6q97-jv69.json +++ b/advisories/unreviewed/2024/04/GHSA-cq2v-6q97-jv69/GHSA-cq2v-6q97-jv69.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-cq2v-6q97-jv69", - "modified": "2024-04-28T12:30:27Z", + "modified": "2025-03-28T00:31:28Z", "published": "2024-04-08T12:30:32Z", "aliases": [ "CVE-2024-26811" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate payload size in ipc response\n\nIf installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc\nresponse to ksmbd kernel server. ksmbd should validate payload size of\nipc response from ksmbd.mountd to avoid memory overrun or\nslab-out-of-bounds. This patch validate 3 ipc response that has payload.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -48,8 +53,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-787" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-08T10:15:08Z" diff --git a/advisories/unreviewed/2024/04/GHSA-rm2h-rx39-6fc3/GHSA-rm2h-rx39-6fc3.json b/advisories/unreviewed/2024/04/GHSA-rm2h-rx39-6fc3/GHSA-rm2h-rx39-6fc3.json index 01aa1eb474f..0682e9ecbd9 100644 --- a/advisories/unreviewed/2024/04/GHSA-rm2h-rx39-6fc3/GHSA-rm2h-rx39-6fc3.json +++ b/advisories/unreviewed/2024/04/GHSA-rm2h-rx39-6fc3/GHSA-rm2h-rx39-6fc3.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-rm2h-rx39-6fc3", - "modified": "2024-06-26T00:31:36Z", + "modified": "2025-03-28T00:31:28Z", "published": "2024-04-05T09:30:39Z", "aliases": [ "CVE-2024-26814" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/fsl-mc: Block calling interrupt handler without trigger\n\nThe eventfd_ctx trigger pointer of the vfio_fsl_mc_irq object is\ninitially NULL and may become NULL if the user sets the trigger\neventfd to -1. The interrupt handler itself is guaranteed that\ntrigger is always valid between request_irq() and free_irq(), but\nthe loopback testing mechanisms to invoke the handler function\nneed to test the trigger. The triggering and setting ioctl paths\nboth make use of igate and are therefore mutually exclusive.\n\nThe vfio-fsl-mc driver does not make use of irqfds, nor does it\nsupport any sort of masking operations, therefore unlike vfio-pci\nand vfio-platform, the flow can remain essentially unchanged.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -48,8 +53,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-05T09:15:09Z" diff --git a/advisories/unreviewed/2025/02/GHSA-q3rr-g46f-jgqr/GHSA-q3rr-g46f-jgqr.json b/advisories/unreviewed/2025/02/GHSA-q3rr-g46f-jgqr/GHSA-q3rr-g46f-jgqr.json index 2ae7ca7c541..3abd1b06d0f 100644 --- a/advisories/unreviewed/2025/02/GHSA-q3rr-g46f-jgqr/GHSA-q3rr-g46f-jgqr.json +++ b/advisories/unreviewed/2025/02/GHSA-q3rr-g46f-jgqr/GHSA-q3rr-g46f-jgqr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-q3rr-g46f-jgqr", - "modified": "2025-03-17T06:30:24Z", + "modified": "2025-03-28T00:31:29Z", "published": "2025-02-19T21:31:38Z", "aliases": [ "CVE-2025-0624" @@ -51,6 +51,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:2869" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:3367" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2025-0624" diff --git a/advisories/unreviewed/2025/03/GHSA-32xp-gg7c-5hwm/GHSA-32xp-gg7c-5hwm.json b/advisories/unreviewed/2025/03/GHSA-32xp-gg7c-5hwm/GHSA-32xp-gg7c-5hwm.json new file mode 100644 index 00000000000..b199d80bce3 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-32xp-gg7c-5hwm/GHSA-32xp-gg7c-5hwm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-32xp-gg7c-5hwm", + "modified": "2025-03-28T00:31:29Z", + "published": "2025-03-28T00:31:29Z", + "aliases": [ + "CVE-2025-22739" + ], + "details": "Missing Authorization vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.2.7.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22739" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-2-7-5-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T22:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-33fg-76g4-jv5r/GHSA-33fg-76g4-jv5r.json b/advisories/unreviewed/2025/03/GHSA-33fg-76g4-jv5r/GHSA-33fg-76g4-jv5r.json new file mode 100644 index 00000000000..158fdde979a --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-33fg-76g4-jv5r/GHSA-33fg-76g4-jv5r.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-33fg-76g4-jv5r", + "modified": "2025-03-28T00:31:30Z", + "published": "2025-03-28T00:31:29Z", + "aliases": [ + "CVE-2025-26898" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler.This issue affects Traveler: from n/a through 3.1.8.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26898" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/theme/traveler/vulnerability/wordpress-traveler-theme-3-1-8-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T22:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-3wrq-rm5m-mgw2/GHSA-3wrq-rm5m-mgw2.json b/advisories/unreviewed/2025/03/GHSA-3wrq-rm5m-mgw2/GHSA-3wrq-rm5m-mgw2.json new file mode 100644 index 00000000000..1fb47765efe --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-3wrq-rm5m-mgw2/GHSA-3wrq-rm5m-mgw2.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3wrq-rm5m-mgw2", + "modified": "2025-03-28T00:31:29Z", + "published": "2025-03-28T00:31:29Z", + "aliases": [ + "CVE-2025-26873" + ], + "details": "Deserialization of Untrusted Data vulnerability in Shinetheme Traveler.This issue affects Traveler: from n/a through 3.1.8.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26873" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/theme/traveler/vulnerability/wordpress-traveler-theme-3-1-8-php-object-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T22:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-48q4-2p6c-rxg9/GHSA-48q4-2p6c-rxg9.json b/advisories/unreviewed/2025/03/GHSA-48q4-2p6c-rxg9/GHSA-48q4-2p6c-rxg9.json new file mode 100644 index 00000000000..41e609b4bab --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-48q4-2p6c-rxg9/GHSA-48q4-2p6c-rxg9.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-48q4-2p6c-rxg9", + "modified": "2025-03-28T00:31:29Z", + "published": "2025-03-28T00:31:29Z", + "aliases": [ + "CVE-2025-22740" + ], + "details": "Missing Authorization vulnerability in Automattic Sensei LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sensei LMS: from n/a through 4.24.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22740" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/sensei-lms/vulnerability/wordpress-sensei-lms-plugin-4-24-4-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T22:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-4p9h-w8fh-6cjm/GHSA-4p9h-w8fh-6cjm.json b/advisories/unreviewed/2025/03/GHSA-4p9h-w8fh-6cjm/GHSA-4p9h-w8fh-6cjm.json new file mode 100644 index 00000000000..49bcf26964f --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-4p9h-w8fh-6cjm/GHSA-4p9h-w8fh-6cjm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4p9h-w8fh-6cjm", + "modified": "2025-03-28T00:31:30Z", + "published": "2025-03-28T00:31:30Z", + "aliases": [ + "CVE-2025-31101" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vault Group Pty Ltd VaultRE Contact Form 7 allows Stored XSS.This issue affects VaultRE Contact Form 7: from n/a through 1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31101" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-plugin-contact-form-7/vulnerability/wordpress-vaultre-contact-form-7-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T23:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-6638-q8q5-j5h6/GHSA-6638-q8q5-j5h6.json b/advisories/unreviewed/2025/03/GHSA-6638-q8q5-j5h6/GHSA-6638-q8q5-j5h6.json new file mode 100644 index 00000000000..9688175430a --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-6638-q8q5-j5h6/GHSA-6638-q8q5-j5h6.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6638-q8q5-j5h6", + "modified": "2025-03-28T00:31:29Z", + "published": "2025-03-28T00:31:29Z", + "aliases": [ + "CVE-2025-26874" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MemberSpace allows Reflected XSS.This issue affects MemberSpace: from n/a through 2.1.13.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26874" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/memberspace/vulnerability/wordpress-memberspace-plugin-2-1-13-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T22:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-7x38-336c-qcwr/GHSA-7x38-336c-qcwr.json b/advisories/unreviewed/2025/03/GHSA-7x38-336c-qcwr/GHSA-7x38-336c-qcwr.json new file mode 100644 index 00000000000..727e26b38b2 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-7x38-336c-qcwr/GHSA-7x38-336c-qcwr.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7x38-336c-qcwr", + "modified": "2025-03-28T00:31:30Z", + "published": "2025-03-28T00:31:30Z", + "aliases": [ + "CVE-2025-2878" + ], + "details": "A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /CMSInstall/install.aspx of the component Additional Database Installation Wizard. The manipulation of the argument new database leads to cross site scripting. The attack can be launched remotely. Upgrading to version 13.0.179 is able to address this issue. It is recommended to upgrade the affected component.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2878" + }, + { + "type": "WEB", + "url": "https://devnet.kentico.com/download/hotfixes" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.301813" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.301813" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.503058" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T23:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-858x-f5c5-vm84/GHSA-858x-f5c5-vm84.json b/advisories/unreviewed/2025/03/GHSA-858x-f5c5-vm84/GHSA-858x-f5c5-vm84.json new file mode 100644 index 00000000000..c520b88bf89 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-858x-f5c5-vm84/GHSA-858x-f5c5-vm84.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-858x-f5c5-vm84", + "modified": "2025-03-28T00:31:30Z", + "published": "2025-03-28T00:31:30Z", + "aliases": [ + "CVE-2025-26890" + ], + "details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginUs.Net HUSKY allows PHP Local File Inclusion.This issue affects HUSKY: from n/a through 1.3.6.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26890" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/woocommerce-products-filter/vulnerability/wordpress-husky-plugin-1-3-6-4-local-file-inclusion-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-98" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T22:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-8w5m-q4c7-vwgq/GHSA-8w5m-q4c7-vwgq.json b/advisories/unreviewed/2025/03/GHSA-8w5m-q4c7-vwgq/GHSA-8w5m-q4c7-vwgq.json new file mode 100644 index 00000000000..040e8015171 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-8w5m-q4c7-vwgq/GHSA-8w5m-q4c7-vwgq.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8w5m-q4c7-vwgq", + "modified": "2025-03-28T00:31:29Z", + "published": "2025-03-28T00:31:29Z", + "aliases": [ + "CVE-2025-26733" + ], + "details": "Missing Authorization vulnerability in Shinetheme Traveler.This issue affects Traveler: from n/a through 3.1.8.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26733" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/theme/traveler/vulnerability/wordpress-traveler-theme-3-1-8-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T22:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-8w8q-78fg-h887/GHSA-8w8q-78fg-h887.json b/advisories/unreviewed/2025/03/GHSA-8w8q-78fg-h887/GHSA-8w8q-78fg-h887.json new file mode 100644 index 00000000000..bff0e69ca0e --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-8w8q-78fg-h887/GHSA-8w8q-78fg-h887.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8w8q-78fg-h887", + "modified": "2025-03-28T00:31:30Z", + "published": "2025-03-28T00:31:30Z", + "aliases": [ + "CVE-2025-31092" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget allows Stored XSS. This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through 2.3.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31092" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/support-chat/vulnerability/wordpress-click-to-chat-wp-support-all-in-one-floating-widget-plugin-2-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-28T00:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-gw2w-6qgf-9h98/GHSA-gw2w-6qgf-9h98.json b/advisories/unreviewed/2025/03/GHSA-gw2w-6qgf-9h98/GHSA-gw2w-6qgf-9h98.json new file mode 100644 index 00000000000..9c379c33b97 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-gw2w-6qgf-9h98/GHSA-gw2w-6qgf-9h98.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gw2w-6qgf-9h98", + "modified": "2025-03-28T00:31:30Z", + "published": "2025-03-28T00:31:30Z", + "aliases": [ + "CVE-2025-31031" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Job Colors for WP Job Manager allows Stored XSS.This issue affects Job Colors for WP Job Manager: from n/a through 1.0.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31031" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-job-manager-colors/vulnerability/wordpress-job-colors-for-wp-job-manager-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T23:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-hgg5-pp3m-2v92/GHSA-hgg5-pp3m-2v92.json b/advisories/unreviewed/2025/03/GHSA-hgg5-pp3m-2v92/GHSA-hgg5-pp3m-2v92.json new file mode 100644 index 00000000000..9c15e2632cf --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-hgg5-pp3m-2v92/GHSA-hgg5-pp3m-2v92.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hgg5-pp3m-2v92", + "modified": "2025-03-28T00:31:30Z", + "published": "2025-03-28T00:31:30Z", + "aliases": [ + "CVE-2025-26956" + ], + "details": "Missing Authorization vulnerability in Shinetheme Traveler.This issue affects Traveler: from n/a through 3.1.8.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26956" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/theme/traveler/vulnerability/wordpress-traveler-theme-3-1-8-broken-access-control-vulnerability-2?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T22:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-jfqh-c88v-ccr7/GHSA-jfqh-c88v-ccr7.json b/advisories/unreviewed/2025/03/GHSA-jfqh-c88v-ccr7/GHSA-jfqh-c88v-ccr7.json new file mode 100644 index 00000000000..a0a3c138444 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-jfqh-c88v-ccr7/GHSA-jfqh-c88v-ccr7.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jfqh-c88v-ccr7", + "modified": "2025-03-28T00:31:29Z", + "published": "2025-03-28T00:31:29Z", + "aliases": [ + "CVE-2025-28253" + ], + "details": "Cross-Site Scripting (XSS) vulnerability in MainWP MainWP Dashboard v5.3.4 exists in class/class-mainwp-post-handler.php, where unsanitized user input from $_POST['sites'], $_POST['clients'], and $_POST['search'] is passed into the MainWP_User::render_table function. Despite using sanitize_text_field and wp_unslash, the values are not adequately protected against HTML or script injection. This flaw could allow an attacker to inject malicious scripts.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28253" + }, + { + "type": "WEB", + "url": "https://github.com/edwin-0990/CVE_ID/tree/main/CVE-2025-28253" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T23:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-qw8f-786p-mp4v/GHSA-qw8f-786p-mp4v.json b/advisories/unreviewed/2025/03/GHSA-qw8f-786p-mp4v/GHSA-qw8f-786p-mp4v.json new file mode 100644 index 00000000000..4d87aff5443 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-qw8f-786p-mp4v/GHSA-qw8f-786p-mp4v.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qw8f-786p-mp4v", + "modified": "2025-03-28T00:31:30Z", + "published": "2025-03-28T00:31:30Z", + "aliases": [ + "CVE-2025-30232" + ], + "details": "A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30232" + }, + { + "type": "WEB", + "url": "https://www.exim.org/static/doc/security/CVE-2025-30232.txt" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-28T00:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-r6gw-8vw8-65gm/GHSA-r6gw-8vw8-65gm.json b/advisories/unreviewed/2025/03/GHSA-r6gw-8vw8-65gm/GHSA-r6gw-8vw8-65gm.json index 2fc23d6519d..326df170a5c 100644 --- a/advisories/unreviewed/2025/03/GHSA-r6gw-8vw8-65gm/GHSA-r6gw-8vw8-65gm.json +++ b/advisories/unreviewed/2025/03/GHSA-r6gw-8vw8-65gm/GHSA-r6gw-8vw8-65gm.json @@ -30,7 +30,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-862" + "CWE-862", + "CWE-863" ], "severity": "MODERATE", "github_reviewed": false,