From 81757867b9e32f6d56d24bea5a1876029043d688 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 10 Apr 2025 18:33:27 +0000
Subject: [PATCH] Advisory Database Sync
---
.../GHSA-wcp3-6gpr-378g.json | 9 +++-
.../GHSA-2cm4-gp34-f42x.json | 3 +-
.../GHSA-5428-jhfr-7hxg.json | 1 +
.../GHSA-6366-2h38-jf23.json | 1 +
.../GHSA-643p-43m5-cqgx.json | 3 +-
.../GHSA-7f63-rxj5-2547.json | 5 ++-
.../GHSA-7qgx-72cr-wfmf.json | 4 +-
.../GHSA-8vf5-p8pr-vxr2.json | 3 +-
.../GHSA-98qx-42h7-g53p.json | 3 +-
.../GHSA-cq6r-f9cc-jg4w.json | 1 +
.../GHSA-g3h6-cfp7-4w45.json | 3 +-
.../GHSA-gq48-j7w4-j44w.json | 3 +-
.../GHSA-jmx6-gw67-2vg8.json | 4 +-
.../GHSA-m83p-93v4-4j26.json | 3 +-
.../GHSA-q348-8x26-5676.json | 4 +-
.../GHSA-q3fg-223f-3hvq.json | 1 +
.../GHSA-q4xj-37rv-g8rw.json | 1 +
.../GHSA-rr8q-hjpq-9wx8.json | 3 +-
.../GHSA-v7rx-x7hp-vgjv.json | 1 +
.../GHSA-2v57-2gwr-vg5h.json | 2 +-
.../GHSA-335h-h5hx-g42j.json | 2 +-
.../GHSA-5684-4xfg-mxj4.json | 10 ++++-
.../GHSA-2x57-wp24-3gfm.json | 2 +-
.../GHSA-2648-xh5w-2w3q.json | 15 +++++--
.../GHSA-2xg8-765h-q668.json | 15 +++++--
.../GHSA-5g8p-x9mm-c9vr.json | 15 +++++--
.../GHSA-5vpp-hj53-v2pr.json | 15 +++++--
.../GHSA-66cx-2vhc-36f5.json | 15 +++++--
.../GHSA-68gg-f4cj-w6g2.json | 15 +++++--
.../GHSA-6hcp-x8fr-rwcv.json | 15 +++++--
.../GHSA-7c5j-6262-p78w.json | 15 +++++--
.../GHSA-7j34-4m8p-353w.json | 15 +++++--
.../GHSA-84gc-cf68-frm5.json | 15 +++++--
.../GHSA-c5f2-596r-9c4q.json | 15 +++++--
.../GHSA-c8qg-683p-cf3w.json | 44 +++++++++++++++++++
.../GHSA-f3mw-fg4x-6x2p.json | 15 +++++--
.../GHSA-g6m7-g8x5-2xv4.json | 6 ++-
.../GHSA-hg9x-8q33-pg7f.json | 6 ++-
.../GHSA-hgp9-3v5v-223j.json | 3 +-
.../GHSA-m7f8-37g5-8r53.json | 6 ++-
.../GHSA-m7pp-g2rm-wrcq.json | 15 +++++--
.../GHSA-p2xq-87xh-464r.json | 15 +++++--
.../GHSA-pg24-62pw-76fp.json | 15 +++++--
.../GHSA-pm2v-rvr8-mpff.json | 11 +++--
.../GHSA-q5wj-cxq5-m47h.json | 15 +++++--
.../GHSA-q8gq-3hw2-45xc.json | 15 +++++--
.../GHSA-qf9h-wvgw-cqh6.json | 15 +++++--
.../GHSA-qpfh-2wpm-c362.json | 36 +++++++++++++++
.../GHSA-r89f-5fp9-fmg7.json | 15 +++++--
.../GHSA-xfq9-hh5x-xfq9.json | 36 +++++++++++++++
50 files changed, 403 insertions(+), 102 deletions(-)
create mode 100644 advisories/unreviewed/2025/04/GHSA-c8qg-683p-cf3w/GHSA-c8qg-683p-cf3w.json
create mode 100644 advisories/unreviewed/2025/04/GHSA-qpfh-2wpm-c362/GHSA-qpfh-2wpm-c362.json
create mode 100644 advisories/unreviewed/2025/04/GHSA-xfq9-hh5x-xfq9/GHSA-xfq9-hh5x-xfq9.json
diff --git a/advisories/unreviewed/2022/01/GHSA-wcp3-6gpr-378g/GHSA-wcp3-6gpr-378g.json b/advisories/unreviewed/2022/01/GHSA-wcp3-6gpr-378g/GHSA-wcp3-6gpr-378g.json
index eced99d688b..5e439b05644 100644
--- a/advisories/unreviewed/2022/01/GHSA-wcp3-6gpr-378g/GHSA-wcp3-6gpr-378g.json
+++ b/advisories/unreviewed/2022/01/GHSA-wcp3-6gpr-378g/GHSA-wcp3-6gpr-378g.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wcp3-6gpr-378g",
- "modified": "2022-01-26T00:02:11Z",
+ "modified": "2025-04-10T18:31:40Z",
"published": "2022-01-21T00:00:52Z",
"aliases": [
"CVE-2021-46026"
],
"details": "mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add blog tag function in the blog tag in the background blog management.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+ }
+ ],
"affected": [],
"references": [
{
diff --git a/advisories/unreviewed/2023/01/GHSA-2cm4-gp34-f42x/GHSA-2cm4-gp34-f42x.json b/advisories/unreviewed/2023/01/GHSA-2cm4-gp34-f42x/GHSA-2cm4-gp34-f42x.json
index ed7838a7e68..ce00a005802 100644
--- a/advisories/unreviewed/2023/01/GHSA-2cm4-gp34-f42x/GHSA-2cm4-gp34-f42x.json
+++ b/advisories/unreviewed/2023/01/GHSA-2cm4-gp34-f42x/GHSA-2cm4-gp34-f42x.json
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-20"
+ "CWE-20",
+ "CWE-787"
],
"severity": "MODERATE",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2023/01/GHSA-5428-jhfr-7hxg/GHSA-5428-jhfr-7hxg.json b/advisories/unreviewed/2023/01/GHSA-5428-jhfr-7hxg/GHSA-5428-jhfr-7hxg.json
index 044b2ef3858..f69163a6877 100644
--- a/advisories/unreviewed/2023/01/GHSA-5428-jhfr-7hxg/GHSA-5428-jhfr-7hxg.json
+++ b/advisories/unreviewed/2023/01/GHSA-5428-jhfr-7hxg/GHSA-5428-jhfr-7hxg.json
@@ -26,6 +26,7 @@
],
"database_specific": {
"cwe_ids": [
+ "CWE-125",
"CWE-200"
],
"severity": "MODERATE",
diff --git a/advisories/unreviewed/2023/01/GHSA-6366-2h38-jf23/GHSA-6366-2h38-jf23.json b/advisories/unreviewed/2023/01/GHSA-6366-2h38-jf23/GHSA-6366-2h38-jf23.json
index 9577e52ee12..0efc5c6ad87 100644
--- a/advisories/unreviewed/2023/01/GHSA-6366-2h38-jf23/GHSA-6366-2h38-jf23.json
+++ b/advisories/unreviewed/2023/01/GHSA-6366-2h38-jf23/GHSA-6366-2h38-jf23.json
@@ -26,6 +26,7 @@
],
"database_specific": {
"cwe_ids": [
+ "CWE-362",
"CWE-662"
],
"severity": "MODERATE",
diff --git a/advisories/unreviewed/2023/01/GHSA-643p-43m5-cqgx/GHSA-643p-43m5-cqgx.json b/advisories/unreviewed/2023/01/GHSA-643p-43m5-cqgx/GHSA-643p-43m5-cqgx.json
index 3e1818c93ea..3d1b6fc9719 100644
--- a/advisories/unreviewed/2023/01/GHSA-643p-43m5-cqgx/GHSA-643p-43m5-cqgx.json
+++ b/advisories/unreviewed/2023/01/GHSA-643p-43m5-cqgx/GHSA-643p-43m5-cqgx.json
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-77"
+ "CWE-77",
+ "CWE-78"
],
"severity": "HIGH",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2023/01/GHSA-7f63-rxj5-2547/GHSA-7f63-rxj5-2547.json b/advisories/unreviewed/2023/01/GHSA-7f63-rxj5-2547/GHSA-7f63-rxj5-2547.json
index 041f833aad6..d17de6602ca 100644
--- a/advisories/unreviewed/2023/01/GHSA-7f63-rxj5-2547/GHSA-7f63-rxj5-2547.json
+++ b/advisories/unreviewed/2023/01/GHSA-7f63-rxj5-2547/GHSA-7f63-rxj5-2547.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7f63-rxj5-2547",
- "modified": "2023-01-09T21:30:21Z",
+ "modified": "2025-04-10T18:31:42Z",
"published": "2023-01-03T00:30:43Z",
"aliases": [
"CVE-2022-3460"
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-200"
+ "CWE-200",
+ "CWE-212"
],
"severity": "HIGH",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2023/01/GHSA-7qgx-72cr-wfmf/GHSA-7qgx-72cr-wfmf.json b/advisories/unreviewed/2023/01/GHSA-7qgx-72cr-wfmf/GHSA-7qgx-72cr-wfmf.json
index 2c54cb2bcdc..eaacf6798af 100644
--- a/advisories/unreviewed/2023/01/GHSA-7qgx-72cr-wfmf/GHSA-7qgx-72cr-wfmf.json
+++ b/advisories/unreviewed/2023/01/GHSA-7qgx-72cr-wfmf/GHSA-7qgx-72cr-wfmf.json
@@ -25,7 +25,9 @@
}
],
"database_specific": {
- "cwe_ids": [],
+ "cwe_ids": [
+ "CWE-269"
+ ],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
diff --git a/advisories/unreviewed/2023/01/GHSA-8vf5-p8pr-vxr2/GHSA-8vf5-p8pr-vxr2.json b/advisories/unreviewed/2023/01/GHSA-8vf5-p8pr-vxr2/GHSA-8vf5-p8pr-vxr2.json
index bdee842d6a4..51c9aab10f3 100644
--- a/advisories/unreviewed/2023/01/GHSA-8vf5-p8pr-vxr2/GHSA-8vf5-p8pr-vxr2.json
+++ b/advisories/unreviewed/2023/01/GHSA-8vf5-p8pr-vxr2/GHSA-8vf5-p8pr-vxr2.json
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-20"
+ "CWE-20",
+ "CWE-787"
],
"severity": "MODERATE",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2023/01/GHSA-98qx-42h7-g53p/GHSA-98qx-42h7-g53p.json b/advisories/unreviewed/2023/01/GHSA-98qx-42h7-g53p/GHSA-98qx-42h7-g53p.json
index afd4a654f3e..52690948ef5 100644
--- a/advisories/unreviewed/2023/01/GHSA-98qx-42h7-g53p/GHSA-98qx-42h7-g53p.json
+++ b/advisories/unreviewed/2023/01/GHSA-98qx-42h7-g53p/GHSA-98qx-42h7-g53p.json
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-77"
+ "CWE-77",
+ "CWE-78"
],
"severity": "HIGH",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2023/01/GHSA-cq6r-f9cc-jg4w/GHSA-cq6r-f9cc-jg4w.json b/advisories/unreviewed/2023/01/GHSA-cq6r-f9cc-jg4w/GHSA-cq6r-f9cc-jg4w.json
index 0d15fec07ef..fabd10d4fc4 100644
--- a/advisories/unreviewed/2023/01/GHSA-cq6r-f9cc-jg4w/GHSA-cq6r-f9cc-jg4w.json
+++ b/advisories/unreviewed/2023/01/GHSA-cq6r-f9cc-jg4w/GHSA-cq6r-f9cc-jg4w.json
@@ -26,6 +26,7 @@
],
"database_specific": {
"cwe_ids": [
+ "CWE-74",
"CWE-94"
],
"severity": "HIGH",
diff --git a/advisories/unreviewed/2023/01/GHSA-g3h6-cfp7-4w45/GHSA-g3h6-cfp7-4w45.json b/advisories/unreviewed/2023/01/GHSA-g3h6-cfp7-4w45/GHSA-g3h6-cfp7-4w45.json
index 7f39b4fe95f..cf3d2293fc8 100644
--- a/advisories/unreviewed/2023/01/GHSA-g3h6-cfp7-4w45/GHSA-g3h6-cfp7-4w45.json
+++ b/advisories/unreviewed/2023/01/GHSA-g3h6-cfp7-4w45/GHSA-g3h6-cfp7-4w45.json
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-77"
+ "CWE-77",
+ "CWE-78"
],
"severity": "HIGH",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2023/01/GHSA-gq48-j7w4-j44w/GHSA-gq48-j7w4-j44w.json b/advisories/unreviewed/2023/01/GHSA-gq48-j7w4-j44w/GHSA-gq48-j7w4-j44w.json
index 583dfeb61d6..1cd5bdce0a9 100644
--- a/advisories/unreviewed/2023/01/GHSA-gq48-j7w4-j44w/GHSA-gq48-j7w4-j44w.json
+++ b/advisories/unreviewed/2023/01/GHSA-gq48-j7w4-j44w/GHSA-gq48-j7w4-j44w.json
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-20"
+ "CWE-20",
+ "CWE-787"
],
"severity": "MODERATE",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2023/01/GHSA-jmx6-gw67-2vg8/GHSA-jmx6-gw67-2vg8.json b/advisories/unreviewed/2023/01/GHSA-jmx6-gw67-2vg8/GHSA-jmx6-gw67-2vg8.json
index 0bdd4cabb15..05430c55da0 100644
--- a/advisories/unreviewed/2023/01/GHSA-jmx6-gw67-2vg8/GHSA-jmx6-gw67-2vg8.json
+++ b/advisories/unreviewed/2023/01/GHSA-jmx6-gw67-2vg8/GHSA-jmx6-gw67-2vg8.json
@@ -25,7 +25,9 @@
}
],
"database_specific": {
- "cwe_ids": [],
+ "cwe_ids": [
+ "CWE-269"
+ ],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
diff --git a/advisories/unreviewed/2023/01/GHSA-m83p-93v4-4j26/GHSA-m83p-93v4-4j26.json b/advisories/unreviewed/2023/01/GHSA-m83p-93v4-4j26/GHSA-m83p-93v4-4j26.json
index 02a033d8165..b8088dc913e 100644
--- a/advisories/unreviewed/2023/01/GHSA-m83p-93v4-4j26/GHSA-m83p-93v4-4j26.json
+++ b/advisories/unreviewed/2023/01/GHSA-m83p-93v4-4j26/GHSA-m83p-93v4-4j26.json
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-20"
+ "CWE-20",
+ "CWE-787"
],
"severity": "MODERATE",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2023/01/GHSA-q348-8x26-5676/GHSA-q348-8x26-5676.json b/advisories/unreviewed/2023/01/GHSA-q348-8x26-5676/GHSA-q348-8x26-5676.json
index 3089391f586..7ed959b9755 100644
--- a/advisories/unreviewed/2023/01/GHSA-q348-8x26-5676/GHSA-q348-8x26-5676.json
+++ b/advisories/unreviewed/2023/01/GHSA-q348-8x26-5676/GHSA-q348-8x26-5676.json
@@ -25,7 +25,9 @@
}
],
"database_specific": {
- "cwe_ids": [],
+ "cwe_ids": [
+ "CWE-269"
+ ],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
diff --git a/advisories/unreviewed/2023/01/GHSA-q3fg-223f-3hvq/GHSA-q3fg-223f-3hvq.json b/advisories/unreviewed/2023/01/GHSA-q3fg-223f-3hvq/GHSA-q3fg-223f-3hvq.json
index eca9ecc2f98..601574e8dae 100644
--- a/advisories/unreviewed/2023/01/GHSA-q3fg-223f-3hvq/GHSA-q3fg-223f-3hvq.json
+++ b/advisories/unreviewed/2023/01/GHSA-q3fg-223f-3hvq/GHSA-q3fg-223f-3hvq.json
@@ -26,6 +26,7 @@
],
"database_specific": {
"cwe_ids": [
+ "CWE-125",
"CWE-20"
],
"severity": "MODERATE",
diff --git a/advisories/unreviewed/2023/01/GHSA-q4xj-37rv-g8rw/GHSA-q4xj-37rv-g8rw.json b/advisories/unreviewed/2023/01/GHSA-q4xj-37rv-g8rw/GHSA-q4xj-37rv-g8rw.json
index 0b0c9d6e09b..cc23796b9d1 100644
--- a/advisories/unreviewed/2023/01/GHSA-q4xj-37rv-g8rw/GHSA-q4xj-37rv-g8rw.json
+++ b/advisories/unreviewed/2023/01/GHSA-q4xj-37rv-g8rw/GHSA-q4xj-37rv-g8rw.json
@@ -26,6 +26,7 @@
],
"database_specific": {
"cwe_ids": [
+ "CWE-122",
"CWE-787"
],
"severity": "MODERATE",
diff --git a/advisories/unreviewed/2023/01/GHSA-rr8q-hjpq-9wx8/GHSA-rr8q-hjpq-9wx8.json b/advisories/unreviewed/2023/01/GHSA-rr8q-hjpq-9wx8/GHSA-rr8q-hjpq-9wx8.json
index 5eefebfd878..c780d7ce52d 100644
--- a/advisories/unreviewed/2023/01/GHSA-rr8q-hjpq-9wx8/GHSA-rr8q-hjpq-9wx8.json
+++ b/advisories/unreviewed/2023/01/GHSA-rr8q-hjpq-9wx8/GHSA-rr8q-hjpq-9wx8.json
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-20"
+ "CWE-20",
+ "CWE-787"
],
"severity": "MODERATE",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2023/01/GHSA-v7rx-x7hp-vgjv/GHSA-v7rx-x7hp-vgjv.json b/advisories/unreviewed/2023/01/GHSA-v7rx-x7hp-vgjv/GHSA-v7rx-x7hp-vgjv.json
index 93ab9bb45e6..b7a07f30c34 100644
--- a/advisories/unreviewed/2023/01/GHSA-v7rx-x7hp-vgjv/GHSA-v7rx-x7hp-vgjv.json
+++ b/advisories/unreviewed/2023/01/GHSA-v7rx-x7hp-vgjv/GHSA-v7rx-x7hp-vgjv.json
@@ -26,6 +26,7 @@
],
"database_specific": {
"cwe_ids": [
+ "CWE-122",
"CWE-787"
],
"severity": "MODERATE",
diff --git a/advisories/unreviewed/2024/11/GHSA-2v57-2gwr-vg5h/GHSA-2v57-2gwr-vg5h.json b/advisories/unreviewed/2024/11/GHSA-2v57-2gwr-vg5h/GHSA-2v57-2gwr-vg5h.json
index 980f9af8975..8cf0a3dcbdd 100644
--- a/advisories/unreviewed/2024/11/GHSA-2v57-2gwr-vg5h/GHSA-2v57-2gwr-vg5h.json
+++ b/advisories/unreviewed/2024/11/GHSA-2v57-2gwr-vg5h/GHSA-2v57-2gwr-vg5h.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2v57-2gwr-vg5h",
- "modified": "2024-11-22T21:32:14Z",
+ "modified": "2025-04-10T18:31:55Z",
"published": "2024-11-22T21:32:14Z",
"aliases": [
"CVE-2021-38119"
diff --git a/advisories/unreviewed/2024/11/GHSA-335h-h5hx-g42j/GHSA-335h-h5hx-g42j.json b/advisories/unreviewed/2024/11/GHSA-335h-h5hx-g42j/GHSA-335h-h5hx-g42j.json
index dc2fccce644..97effa687f6 100644
--- a/advisories/unreviewed/2024/11/GHSA-335h-h5hx-g42j/GHSA-335h-h5hx-g42j.json
+++ b/advisories/unreviewed/2024/11/GHSA-335h-h5hx-g42j/GHSA-335h-h5hx-g42j.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-335h-h5hx-g42j",
- "modified": "2024-11-22T21:32:14Z",
+ "modified": "2025-04-10T18:31:55Z",
"published": "2024-11-22T21:32:14Z",
"aliases": [
"CVE-2021-38134"
diff --git a/advisories/unreviewed/2024/11/GHSA-5684-4xfg-mxj4/GHSA-5684-4xfg-mxj4.json b/advisories/unreviewed/2024/11/GHSA-5684-4xfg-mxj4/GHSA-5684-4xfg-mxj4.json
index d99aeb2769c..c1148bdf05a 100644
--- a/advisories/unreviewed/2024/11/GHSA-5684-4xfg-mxj4/GHSA-5684-4xfg-mxj4.json
+++ b/advisories/unreviewed/2024/11/GHSA-5684-4xfg-mxj4/GHSA-5684-4xfg-mxj4.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5684-4xfg-mxj4",
- "modified": "2024-12-11T15:31:15Z",
+ "modified": "2025-04-10T18:31:55Z",
"published": "2024-11-09T12:30:47Z",
"aliases": [
"CVE-2024-50217"
@@ -26,6 +26,14 @@
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/aec8e6bf839101784f3ef037dcdb9432c3f32343"
+ },
+ {
+ "type": "WEB",
+ "url": "http://www.openwall.com/lists/oss-security/2025/04/10/4"
+ },
+ {
+ "type": "WEB",
+ "url": "http://www.openwall.com/lists/oss-security/2025/04/10/5"
}
],
"database_specific": {
diff --git a/advisories/unreviewed/2024/12/GHSA-2x57-wp24-3gfm/GHSA-2x57-wp24-3gfm.json b/advisories/unreviewed/2024/12/GHSA-2x57-wp24-3gfm/GHSA-2x57-wp24-3gfm.json
index 8e817d866cf..6a94a876ce8 100644
--- a/advisories/unreviewed/2024/12/GHSA-2x57-wp24-3gfm/GHSA-2x57-wp24-3gfm.json
+++ b/advisories/unreviewed/2024/12/GHSA-2x57-wp24-3gfm/GHSA-2x57-wp24-3gfm.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2x57-wp24-3gfm",
- "modified": "2024-12-05T15:31:01Z",
+ "modified": "2025-04-10T18:31:55Z",
"published": "2024-12-05T15:31:01Z",
"aliases": [
"CVE-2024-11317"
diff --git a/advisories/unreviewed/2025/04/GHSA-2648-xh5w-2w3q/GHSA-2648-xh5w-2w3q.json b/advisories/unreviewed/2025/04/GHSA-2648-xh5w-2w3q/GHSA-2648-xh5w-2w3q.json
index 0a732bc0037..486c5902b5d 100644
--- a/advisories/unreviewed/2025/04/GHSA-2648-xh5w-2w3q/GHSA-2648-xh5w-2w3q.json
+++ b/advisories/unreviewed/2025/04/GHSA-2648-xh5w-2w3q/GHSA-2648-xh5w-2w3q.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2648-xh5w-2w3q",
- "modified": "2025-04-03T09:32:15Z",
+ "modified": "2025-04-10T18:32:02Z",
"published": "2025-04-03T09:32:15Z",
"aliases": [
"CVE-2025-22003"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: ucan: fix out of bound read in strscpy() source\n\nCommit 7fdaf8966aae (\"can: ucan: use strscpy() to instead of strncpy()\")\nunintentionally introduced a one byte out of bound read on strscpy()'s\nsource argument (which is kind of ironic knowing that strscpy() is meant\nto be a more secure alternative :)).\n\nLet's consider below buffers:\n\n dest[len + 1]; /* will be NUL terminated */\n src[len]; /* may not be NUL terminated */\n\nWhen doing:\n\n strncpy(dest, src, len);\n dest[len] = '\\0';\n\nstrncpy() will read up to len bytes from src.\n\nOn the other hand:\n\n strscpy(dest, src, len + 1);\n\nwill read up to len + 1 bytes from src, that is to say, an out of bound\nread of one byte will occur on src if it is not NUL terminated. Note\nthat the src[len] byte is never copied, but strscpy() still needs to\nread it to check whether a truncation occurred or not.\n\nThis exact pattern happened in ucan.\n\nThe root cause is that the source is not NUL terminated. Instead of\ndoing a copy in a local buffer, directly NUL terminate it as soon as\nusb_control_msg() returns. With this, the local firmware_str[] variable\ncan be removed.\n\nOn top of this do a couple refactors:\n\n - ucan_ctl_payload->raw is only used for the firmware string, so\n rename it to ucan_ctl_payload->fw_str and change its type from u8 to\n char.\n\n - ucan_device_request_in() is only used to retrieve the firmware\n string, so rename it to ucan_get_fw_str() and refactor it to make it\n directly handle all the string termination logic.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -32,8 +37,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-125"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-03T08:15:15Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-2xg8-765h-q668/GHSA-2xg8-765h-q668.json b/advisories/unreviewed/2025/04/GHSA-2xg8-765h-q668/GHSA-2xg8-765h-q668.json
index 4bc30b4e997..1e9a21848e5 100644
--- a/advisories/unreviewed/2025/04/GHSA-2xg8-765h-q668/GHSA-2xg8-765h-q668.json
+++ b/advisories/unreviewed/2025/04/GHSA-2xg8-765h-q668/GHSA-2xg8-765h-q668.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2xg8-765h-q668",
- "modified": "2025-04-03T09:32:15Z",
+ "modified": "2025-04-10T18:32:01Z",
"published": "2025-04-03T09:32:15Z",
"aliases": [
"CVE-2025-22001"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Fix integer overflow in qaic_validate_req()\n\nThese are u64 variables that come from the user via\nqaic_attach_slice_bo_ioctl(). Use check_add_overflow() to ensure that\nthe math doesn't have an integer wrapping bug.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -32,8 +37,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-190"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-03T08:15:15Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-5g8p-x9mm-c9vr/GHSA-5g8p-x9mm-c9vr.json b/advisories/unreviewed/2025/04/GHSA-5g8p-x9mm-c9vr/GHSA-5g8p-x9mm-c9vr.json
index 472a55136ea..0d4cadb8b92 100644
--- a/advisories/unreviewed/2025/04/GHSA-5g8p-x9mm-c9vr/GHSA-5g8p-x9mm-c9vr.json
+++ b/advisories/unreviewed/2025/04/GHSA-5g8p-x9mm-c9vr/GHSA-5g8p-x9mm-c9vr.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5g8p-x9mm-c9vr",
- "modified": "2025-04-01T18:30:53Z",
+ "modified": "2025-04-10T18:32:01Z",
"published": "2025-04-01T18:30:53Z",
"aliases": [
"CVE-2025-21945"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in smb2_lock\n\nIf smb_lock->zero_len has value, ->llist of smb_lock is not delete and\nflock is old one. It will cause use-after-free on error handling\nroutine.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -36,8 +41,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-416"
+ ],
+ "severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T16:15:25Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-5vpp-hj53-v2pr/GHSA-5vpp-hj53-v2pr.json b/advisories/unreviewed/2025/04/GHSA-5vpp-hj53-v2pr/GHSA-5vpp-hj53-v2pr.json
index a1e98881c18..dfe8282754b 100644
--- a/advisories/unreviewed/2025/04/GHSA-5vpp-hj53-v2pr/GHSA-5vpp-hj53-v2pr.json
+++ b/advisories/unreviewed/2025/04/GHSA-5vpp-hj53-v2pr/GHSA-5vpp-hj53-v2pr.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5vpp-hj53-v2pr",
- "modified": "2025-04-01T18:30:52Z",
+ "modified": "2025-04-10T18:32:00Z",
"published": "2025-04-01T18:30:52Z",
"aliases": [
"CVE-2025-21936"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()\n\nAdd check for the return value of mgmt_alloc_skb() in\nmgmt_device_connected() to prevent null pointer dereference.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -36,8 +41,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-476"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T16:15:24Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-66cx-2vhc-36f5/GHSA-66cx-2vhc-36f5.json b/advisories/unreviewed/2025/04/GHSA-66cx-2vhc-36f5/GHSA-66cx-2vhc-36f5.json
index 6c1cf288662..3092e79ce68 100644
--- a/advisories/unreviewed/2025/04/GHSA-66cx-2vhc-36f5/GHSA-66cx-2vhc-36f5.json
+++ b/advisories/unreviewed/2025/04/GHSA-66cx-2vhc-36f5/GHSA-66cx-2vhc-36f5.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-66cx-2vhc-36f5",
- "modified": "2025-04-01T18:30:52Z",
+ "modified": "2025-04-10T18:32:00Z",
"published": "2025-04-01T18:30:52Z",
"aliases": [
"CVE-2025-21937"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()\n\nAdd check for the return value of mgmt_alloc_skb() in\nmgmt_remote_name() to prevent null pointer dereference.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -36,8 +41,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-476"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T16:15:24Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-68gg-f4cj-w6g2/GHSA-68gg-f4cj-w6g2.json b/advisories/unreviewed/2025/04/GHSA-68gg-f4cj-w6g2/GHSA-68gg-f4cj-w6g2.json
index 95445f96233..59f065f6287 100644
--- a/advisories/unreviewed/2025/04/GHSA-68gg-f4cj-w6g2/GHSA-68gg-f4cj-w6g2.json
+++ b/advisories/unreviewed/2025/04/GHSA-68gg-f4cj-w6g2/GHSA-68gg-f4cj-w6g2.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-68gg-f4cj-w6g2",
- "modified": "2025-04-03T09:32:15Z",
+ "modified": "2025-04-10T18:32:01Z",
"published": "2025-04-03T09:32:15Z",
"aliases": [
"CVE-2025-22002"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Call `invalidate_cache` only if implemented\n\nMany filesystems such as NFS and Ceph do not implement the\n`invalidate_cache` method. On those filesystems, if writing to the\ncache (`NETFS_WRITE_TO_CACHE`) fails for some reason, the kernel\ncrashes like this:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor instruction fetch in kernel mode\n #PF: error_code(0x0010) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0010 [#1] SMP PTI\n CPU: 9 UID: 0 PID: 3380 Comm: kworker/u193:11 Not tainted 6.13.3-cm4all1-hp #437\n Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018\n Workqueue: events_unbound netfs_write_collection_worker\n RIP: 0010:0x0\n Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n RSP: 0018:ffff9b86e2ca7dc0 EFLAGS: 00010202\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 7fffffffffffffff\n RDX: 0000000000000001 RSI: ffff89259d576a18 RDI: ffff89259d576900\n RBP: ffff89259d5769b0 R08: ffff9b86e2ca7d28 R09: 0000000000000002\n R10: ffff89258ceaca80 R11: 0000000000000001 R12: 0000000000000020\n R13: ffff893d158b9338 R14: ffff89259d576900 R15: ffff89259d5769b0\n FS: 0000000000000000(0000) GS:ffff893c9fa40000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffffffffffffffd6 CR3: 000000054442e003 CR4: 00000000001706f0\n Call Trace:\n \n ? __die+0x1f/0x60\n ? page_fault_oops+0x15c/0x460\n ? try_to_wake_up+0x2d2/0x530\n ? exc_page_fault+0x5e/0x100\n ? asm_exc_page_fault+0x22/0x30\n netfs_write_collection_worker+0xe9f/0x12b0\n ? xs_poll_check_readable+0x3f/0x80\n ? xs_stream_data_receive_workfn+0x8d/0x110\n process_one_work+0x134/0x2d0\n worker_thread+0x299/0x3a0\n ? __pfx_worker_thread+0x10/0x10\n kthread+0xba/0xe0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x30/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \n Modules linked in:\n CR2: 0000000000000000\n\nThis patch adds the missing `NULL` check.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-476"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-03T08:15:15Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-6hcp-x8fr-rwcv/GHSA-6hcp-x8fr-rwcv.json b/advisories/unreviewed/2025/04/GHSA-6hcp-x8fr-rwcv/GHSA-6hcp-x8fr-rwcv.json
index 43e61a8db7d..03300cf0ec4 100644
--- a/advisories/unreviewed/2025/04/GHSA-6hcp-x8fr-rwcv/GHSA-6hcp-x8fr-rwcv.json
+++ b/advisories/unreviewed/2025/04/GHSA-6hcp-x8fr-rwcv/GHSA-6hcp-x8fr-rwcv.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6hcp-x8fr-rwcv",
- "modified": "2025-04-03T09:32:15Z",
+ "modified": "2025-04-10T18:32:01Z",
"published": "2025-04-03T09:32:15Z",
"aliases": [
"CVE-2025-21998"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: uefisecapp: fix efivars registration race\n\nSince the conversion to using the TZ allocator, the efivars service is\nregistered before the memory pool has been allocated, something which\ncan lead to a NULL-pointer dereference in case of a racing EFI variable\naccess.\n\nMake sure that all resources have been set up before registering the\nefivars.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-367"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-03T08:15:15Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-7c5j-6262-p78w/GHSA-7c5j-6262-p78w.json b/advisories/unreviewed/2025/04/GHSA-7c5j-6262-p78w/GHSA-7c5j-6262-p78w.json
index 340864f044e..5b4b68d5ddf 100644
--- a/advisories/unreviewed/2025/04/GHSA-7c5j-6262-p78w/GHSA-7c5j-6262-p78w.json
+++ b/advisories/unreviewed/2025/04/GHSA-7c5j-6262-p78w/GHSA-7c5j-6262-p78w.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7c5j-6262-p78w",
- "modified": "2025-04-01T18:30:53Z",
+ "modified": "2025-04-10T18:32:01Z",
"published": "2025-04-01T18:30:53Z",
"aliases": [
"CVE-2025-21947"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix type confusion via race condition when using ipc_msg_send_request\n\nreq->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on\nida_alloc. req->handle from ksmbd_ipc_login_request and\nFSCTL_PIPE_TRANSCEIVE ioctl can be same and it could lead to type confusion\nbetween messages, resulting in access to unexpected parts of memory after\nan incorrect delivery. ksmbd check type of ipc response but missing add\ncontinue to check next ipc reponse.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -36,8 +41,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-362"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T16:15:25Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-7j34-4m8p-353w/GHSA-7j34-4m8p-353w.json b/advisories/unreviewed/2025/04/GHSA-7j34-4m8p-353w/GHSA-7j34-4m8p-353w.json
index 54896c606f4..9afb37f3423 100644
--- a/advisories/unreviewed/2025/04/GHSA-7j34-4m8p-353w/GHSA-7j34-4m8p-353w.json
+++ b/advisories/unreviewed/2025/04/GHSA-7j34-4m8p-353w/GHSA-7j34-4m8p-353w.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7j34-4m8p-353w",
- "modified": "2025-04-10T15:31:47Z",
+ "modified": "2025-04-10T18:32:02Z",
"published": "2025-04-03T09:32:15Z",
"aliases": [
"CVE-2025-22005"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().\n\nfib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything\nwhen it fails.\n\nCommit 7dd73168e273 (\"ipv6: Always allocate pcpu memory in a fib6_nh\")\nmoved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init()\nbut forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in\ncase it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak.\n\nLet's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the\nerror path.\n\nNote that we can remove the fib6_nh_release() call in nh_create_ipv6()\nlater in net-next.git.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -48,8 +53,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-401"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-03T08:15:16Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-84gc-cf68-frm5/GHSA-84gc-cf68-frm5.json b/advisories/unreviewed/2025/04/GHSA-84gc-cf68-frm5/GHSA-84gc-cf68-frm5.json
index 8efa1e837e0..8ffcb2b0d1c 100644
--- a/advisories/unreviewed/2025/04/GHSA-84gc-cf68-frm5/GHSA-84gc-cf68-frm5.json
+++ b/advisories/unreviewed/2025/04/GHSA-84gc-cf68-frm5/GHSA-84gc-cf68-frm5.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-84gc-cf68-frm5",
- "modified": "2025-04-03T09:32:15Z",
+ "modified": "2025-04-10T18:32:01Z",
"published": "2025-04-03T09:32:15Z",
"aliases": [
"CVE-2025-22000"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: drop beyond-EOF folios with the right number of refs\n\nWhen an after-split folio is large and needs to be dropped due to EOF,\nfolio_put_refs(folio, folio_nr_pages(folio)) should be used to drop all\npage cache refs. Otherwise, the folio will not be freed, causing memory\nleak.\n\nThis leak would happen on a filesystem with blocksize > page_size and a\ntruncate is performed, where the blocksize makes folios split to >0 order\nones, causing truncated folios not being freed.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-401"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-03T08:15:15Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-c5f2-596r-9c4q/GHSA-c5f2-596r-9c4q.json b/advisories/unreviewed/2025/04/GHSA-c5f2-596r-9c4q/GHSA-c5f2-596r-9c4q.json
index 7f0ace84e28..c4148294947 100644
--- a/advisories/unreviewed/2025/04/GHSA-c5f2-596r-9c4q/GHSA-c5f2-596r-9c4q.json
+++ b/advisories/unreviewed/2025/04/GHSA-c5f2-596r-9c4q/GHSA-c5f2-596r-9c4q.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c5f2-596r-9c4q",
- "modified": "2025-04-03T09:32:15Z",
+ "modified": "2025-04-10T18:32:02Z",
"published": "2025-04-03T09:32:15Z",
"aliases": [
"CVE-2025-22006"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: am65-cpsw: Fix NAPI registration sequence\n\nRegistering the interrupts for TX or RX DMA Channels prior to registering\ntheir respective NAPI callbacks can result in a NULL pointer dereference.\nThis is seen in practice as a random occurrence since it depends on the\nrandomness associated with the generation of traffic by Linux and the\nreception of traffic from the wire.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-476"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-03T08:15:16Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-c8qg-683p-cf3w/GHSA-c8qg-683p-cf3w.json b/advisories/unreviewed/2025/04/GHSA-c8qg-683p-cf3w/GHSA-c8qg-683p-cf3w.json
new file mode 100644
index 00000000000..57ade2062f0
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-c8qg-683p-cf3w/GHSA-c8qg-683p-cf3w.json
@@ -0,0 +1,44 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-c8qg-683p-cf3w",
+ "modified": "2025-04-10T18:31:59Z",
+ "published": "2025-04-10T18:31:59Z",
+ "aliases": [
+ "CVE-2024-13803"
+ ],
+ "details": "The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-marker’ parameter in all versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13803"
+ },
+ {
+ "type": "WEB",
+ "url": "https://plugins.trac.wordpress.org/changeset/3242493"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/efdeca40-e021-478f-af75-c5566ae70735?source=cve"
+ },
+ {
+ "type": "WEB",
+ "url": "http://localhost:1337/wp-content/plugins/essential-blocks/assets/admin/editor/editor.js"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-02-26T13:15:38Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-f3mw-fg4x-6x2p/GHSA-f3mw-fg4x-6x2p.json b/advisories/unreviewed/2025/04/GHSA-f3mw-fg4x-6x2p/GHSA-f3mw-fg4x-6x2p.json
index 8b5a1dd67a7..97fa9adbe95 100644
--- a/advisories/unreviewed/2025/04/GHSA-f3mw-fg4x-6x2p/GHSA-f3mw-fg4x-6x2p.json
+++ b/advisories/unreviewed/2025/04/GHSA-f3mw-fg4x-6x2p/GHSA-f3mw-fg4x-6x2p.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f3mw-fg4x-6x2p",
- "modified": "2025-04-01T18:30:52Z",
+ "modified": "2025-04-10T18:32:00Z",
"published": "2025-04-01T18:30:52Z",
"aliases": [
"CVE-2025-21940"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix NULL Pointer Dereference in KFD queue\n\nThrough KFD IOCTL Fuzzing we encountered a NULL pointer derefrence\nwhen calling kfd_queue_acquire_buffers.\n\n(cherry picked from commit 049e5bf3c8406f87c3d8e1958e0a16804fa1d530)",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-476"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T16:15:24Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-g6m7-g8x5-2xv4/GHSA-g6m7-g8x5-2xv4.json b/advisories/unreviewed/2025/04/GHSA-g6m7-g8x5-2xv4/GHSA-g6m7-g8x5-2xv4.json
index 449097b6adb..6ebbd7ee68c 100644
--- a/advisories/unreviewed/2025/04/GHSA-g6m7-g8x5-2xv4/GHSA-g6m7-g8x5-2xv4.json
+++ b/advisories/unreviewed/2025/04/GHSA-g6m7-g8x5-2xv4/GHSA-g6m7-g8x5-2xv4.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g6m7-g8x5-2xv4",
- "modified": "2025-04-07T18:30:48Z",
+ "modified": "2025-04-10T18:32:02Z",
"published": "2025-04-07T18:30:48Z",
"aliases": [
"CVE-2025-3426"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3426"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.philips.com/a-w/security/security-advisories.html#security_advisories"
}
],
"database_specific": {
diff --git a/advisories/unreviewed/2025/04/GHSA-hg9x-8q33-pg7f/GHSA-hg9x-8q33-pg7f.json b/advisories/unreviewed/2025/04/GHSA-hg9x-8q33-pg7f/GHSA-hg9x-8q33-pg7f.json
index a729fba3e76..1424f40018b 100644
--- a/advisories/unreviewed/2025/04/GHSA-hg9x-8q33-pg7f/GHSA-hg9x-8q33-pg7f.json
+++ b/advisories/unreviewed/2025/04/GHSA-hg9x-8q33-pg7f/GHSA-hg9x-8q33-pg7f.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hg9x-8q33-pg7f",
- "modified": "2025-04-07T18:30:48Z",
+ "modified": "2025-04-10T18:32:02Z",
"published": "2025-04-07T18:30:48Z",
"aliases": [
"CVE-2025-3424"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3424"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.philips.com/a-w/security/security-advisories.html#security_advisories"
}
],
"database_specific": {
diff --git a/advisories/unreviewed/2025/04/GHSA-hgp9-3v5v-223j/GHSA-hgp9-3v5v-223j.json b/advisories/unreviewed/2025/04/GHSA-hgp9-3v5v-223j/GHSA-hgp9-3v5v-223j.json
index 7f3ac509785..8c187bd227e 100644
--- a/advisories/unreviewed/2025/04/GHSA-hgp9-3v5v-223j/GHSA-hgp9-3v5v-223j.json
+++ b/advisories/unreviewed/2025/04/GHSA-hgp9-3v5v-223j/GHSA-hgp9-3v5v-223j.json
@@ -30,7 +30,8 @@
],
"database_specific": {
"cwe_ids": [
- "CWE-321"
+ "CWE-321",
+ "CWE-798"
],
"severity": "CRITICAL",
"github_reviewed": false,
diff --git a/advisories/unreviewed/2025/04/GHSA-m7f8-37g5-8r53/GHSA-m7f8-37g5-8r53.json b/advisories/unreviewed/2025/04/GHSA-m7f8-37g5-8r53/GHSA-m7f8-37g5-8r53.json
index abf125d18f3..ff246a258d9 100644
--- a/advisories/unreviewed/2025/04/GHSA-m7f8-37g5-8r53/GHSA-m7f8-37g5-8r53.json
+++ b/advisories/unreviewed/2025/04/GHSA-m7f8-37g5-8r53/GHSA-m7f8-37g5-8r53.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m7f8-37g5-8r53",
- "modified": "2025-04-07T18:30:48Z",
+ "modified": "2025-04-10T18:32:02Z",
"published": "2025-04-07T18:30:48Z",
"aliases": [
"CVE-2025-3425"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3425"
+ },
+ {
+ "type": "WEB",
+ "url": "https://www.philips.com/a-w/security/security-advisories.html#security_advisories"
}
],
"database_specific": {
diff --git a/advisories/unreviewed/2025/04/GHSA-m7pp-g2rm-wrcq/GHSA-m7pp-g2rm-wrcq.json b/advisories/unreviewed/2025/04/GHSA-m7pp-g2rm-wrcq/GHSA-m7pp-g2rm-wrcq.json
index 706ec92a9bc..dc44ae386b2 100644
--- a/advisories/unreviewed/2025/04/GHSA-m7pp-g2rm-wrcq/GHSA-m7pp-g2rm-wrcq.json
+++ b/advisories/unreviewed/2025/04/GHSA-m7pp-g2rm-wrcq/GHSA-m7pp-g2rm-wrcq.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m7pp-g2rm-wrcq",
- "modified": "2025-04-01T18:30:53Z",
+ "modified": "2025-04-10T18:32:01Z",
"published": "2025-04-01T18:30:53Z",
"aliases": [
"CVE-2025-21943"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: aggregator: protect driver attr handlers against module unload\n\nBoth new_device_store and delete_device_store touch module global\nresources (e.g. gpio_aggregator_lock). To prevent race conditions with\nmodule unload, a reference needs to be held.\n\nAdd try_module_get() in these handlers.\n\nFor new_device_store, this eliminates what appears to be the most dangerous\nscenario: if an id is allocated from gpio_aggregator_idr but\nplatform_device_register has not yet been called or completed, a concurrent\nmodule unload could fail to unregister/delete the device, leaving behind a\ndangling platform device/GPIO forwarder. This can result in various issues.\nThe following simple reproducer demonstrates these problems:\n\n #!/bin/bash\n while :; do\n # note: whether 'gpiochip0 0' exists or not does not matter.\n echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device\n done &\n while :; do\n modprobe gpio-aggregator\n modprobe -r gpio-aggregator\n done &\n wait\n\n Starting with the following warning, several kinds of warnings will appear\n and the system may become unstable:\n\n ------------[ cut here ]------------\n list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100)\n WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120\n [...]\n RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120\n [...]\n Call Trace:\n \n ? __list_del_entry_valid_or_report+0xa3/0x120\n ? __warn.cold+0x93/0xf2\n ? __list_del_entry_valid_or_report+0xa3/0x120\n ? report_bug+0xe6/0x170\n ? __irq_work_queue_local+0x39/0xe0\n ? handle_bug+0x58/0x90\n ? exc_invalid_op+0x13/0x60\n ? asm_exc_invalid_op+0x16/0x20\n ? __list_del_entry_valid_or_report+0xa3/0x120\n gpiod_remove_lookup_table+0x22/0x60\n new_device_store+0x315/0x350 [gpio_aggregator]\n kernfs_fop_write_iter+0x137/0x1f0\n vfs_write+0x262/0x430\n ksys_write+0x60/0xd0\n do_syscall_64+0x6c/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n [...]\n \n ---[ end trace 0000000000000000 ]---",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -44,8 +49,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-362"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T16:15:25Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-p2xq-87xh-464r/GHSA-p2xq-87xh-464r.json b/advisories/unreviewed/2025/04/GHSA-p2xq-87xh-464r/GHSA-p2xq-87xh-464r.json
index 34203d66db6..90665683554 100644
--- a/advisories/unreviewed/2025/04/GHSA-p2xq-87xh-464r/GHSA-p2xq-87xh-464r.json
+++ b/advisories/unreviewed/2025/04/GHSA-p2xq-87xh-464r/GHSA-p2xq-87xh-464r.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p2xq-87xh-464r",
- "modified": "2025-04-01T18:30:52Z",
+ "modified": "2025-04-10T18:32:00Z",
"published": "2025-04-01T18:30:52Z",
"aliases": [
"CVE-2025-21934"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: fix an API misues when rio_add_net() fails\n\nrio_add_net() calls device_register() and fails when device_register()\nfails. Thus, put_device() should be used rather than kfree(). Add\n\"mport->net = NULL;\" to avoid a use after free issue.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -48,8 +53,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-416"
+ ],
+ "severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T16:15:24Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-pg24-62pw-76fp/GHSA-pg24-62pw-76fp.json b/advisories/unreviewed/2025/04/GHSA-pg24-62pw-76fp/GHSA-pg24-62pw-76fp.json
index b7d1dc4e8ff..3e2a5d72bef 100644
--- a/advisories/unreviewed/2025/04/GHSA-pg24-62pw-76fp/GHSA-pg24-62pw-76fp.json
+++ b/advisories/unreviewed/2025/04/GHSA-pg24-62pw-76fp/GHSA-pg24-62pw-76fp.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pg24-62pw-76fp",
- "modified": "2025-04-03T09:32:15Z",
+ "modified": "2025-04-10T18:32:01Z",
"published": "2025-04-03T09:32:15Z",
"aliases": [
"CVE-2025-21997"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: fix an integer overflow in xp_create_and_assign_umem()\n\nSince the i and pool->chunk_size variables are of type 'u32',\ntheir product can wrap around and then be cast to 'u64'.\nThis can lead to two different XDP buffers pointing to the same\nmemory area.\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with SVACE.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -36,8 +41,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-190"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-03T08:15:15Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-pm2v-rvr8-mpff/GHSA-pm2v-rvr8-mpff.json b/advisories/unreviewed/2025/04/GHSA-pm2v-rvr8-mpff/GHSA-pm2v-rvr8-mpff.json
index ce8dcc60552..0b32a67de24 100644
--- a/advisories/unreviewed/2025/04/GHSA-pm2v-rvr8-mpff/GHSA-pm2v-rvr8-mpff.json
+++ b/advisories/unreviewed/2025/04/GHSA-pm2v-rvr8-mpff/GHSA-pm2v-rvr8-mpff.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pm2v-rvr8-mpff",
- "modified": "2025-04-01T18:30:52Z",
+ "modified": "2025-04-10T18:32:00Z",
"published": "2025-04-01T18:30:51Z",
"aliases": [
"CVE-2025-21930"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: don't try to talk to a dead firmware\n\nThis fixes:\n\n bad state = 0\n WARNING: CPU: 10 PID: 702 at drivers/net/wireless/inel/iwlwifi/iwl-trans.c:178 iwl_trans_send_cmd+0xba/0xe0 [iwlwifi]\n Call Trace:\n \n ? __warn+0xca/0x1c0\n ? iwl_trans_send_cmd+0xba/0xe0 [iwlwifi 64fa9ad799a0e0d2ba53d4af93a53ad9a531f8d4]\n iwl_fw_dbg_clear_monitor_buf+0xd7/0x110 [iwlwifi 64fa9ad799a0e0d2ba53d4af93a53ad9a531f8d4]\n _iwl_dbgfs_fw_dbg_clear_write+0xe2/0x120 [iwlmvm 0e8adb18cea92d2c341766bcc10b18699290068a]\n\nAsk whether the firmware is alive before sending a command.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -29,7 +34,7 @@
],
"database_specific": {
"cwe_ids": [],
- "severity": null,
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T16:15:23Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-q5wj-cxq5-m47h/GHSA-q5wj-cxq5-m47h.json b/advisories/unreviewed/2025/04/GHSA-q5wj-cxq5-m47h/GHSA-q5wj-cxq5-m47h.json
index 7fa91a0d4ec..5dcf541a810 100644
--- a/advisories/unreviewed/2025/04/GHSA-q5wj-cxq5-m47h/GHSA-q5wj-cxq5-m47h.json
+++ b/advisories/unreviewed/2025/04/GHSA-q5wj-cxq5-m47h/GHSA-q5wj-cxq5-m47h.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q5wj-cxq5-m47h",
- "modified": "2025-04-01T18:30:52Z",
+ "modified": "2025-04-10T18:32:00Z",
"published": "2025-04-01T18:30:52Z",
"aliases": [
"CVE-2025-21933"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\narm: pgtable: fix NULL pointer dereference issue\n\nWhen update_mmu_cache_range() is called by update_mmu_cache(), the vmf\nparameter is NULL, which will cause a NULL pointer dereference issue in\nadjust_pte():\n\nUnable to handle kernel NULL pointer dereference at virtual address 00000030 when read\nHardware name: Atmel AT91SAM9\nPC is at update_mmu_cache_range+0x1e0/0x278\nLR is at pte_offset_map_rw_nolock+0x18/0x2c\nCall trace:\n update_mmu_cache_range from remove_migration_pte+0x29c/0x2ec\n remove_migration_pte from rmap_walk_file+0xcc/0x130\n rmap_walk_file from remove_migration_ptes+0x90/0xa4\n remove_migration_ptes from migrate_pages_batch+0x6d4/0x858\n migrate_pages_batch from migrate_pages+0x188/0x488\n migrate_pages from compact_zone+0x56c/0x954\n compact_zone from compact_node+0x90/0xf0\n compact_node from kcompactd+0x1d4/0x204\n kcompactd from kthread+0x120/0x12c\n kthread from ret_from_fork+0x14/0x38\nException stack(0xc0d8bfb0 to 0xc0d8bff8)\n\nTo fix it, do not rely on whether 'ptl' is equal to decide whether to hold\nthe pte lock, but decide it by whether CONFIG_SPLIT_PTE_PTLOCKS is\nenabled. In addition, if two vmas map to the same PTE page, there is no\nneed to hold the pte lock again, otherwise a deadlock will occur. Just\nadd the need_lock parameter to let adjust_pte() know this information.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-476"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T16:15:24Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-q8gq-3hw2-45xc/GHSA-q8gq-3hw2-45xc.json b/advisories/unreviewed/2025/04/GHSA-q8gq-3hw2-45xc/GHSA-q8gq-3hw2-45xc.json
index 4180f534ada..aa07cb22866 100644
--- a/advisories/unreviewed/2025/04/GHSA-q8gq-3hw2-45xc/GHSA-q8gq-3hw2-45xc.json
+++ b/advisories/unreviewed/2025/04/GHSA-q8gq-3hw2-45xc/GHSA-q8gq-3hw2-45xc.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q8gq-3hw2-45xc",
- "modified": "2025-04-09T21:31:44Z",
+ "modified": "2025-04-10T18:32:02Z",
"published": "2025-04-09T21:31:44Z",
"aliases": [
"CVE-2025-29018"
],
"details": "A Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages_add_acc_type.php in Code Astro Internet Banking System 2.0.0.",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
+ }
+ ],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-79"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-09T21:16:25Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-qf9h-wvgw-cqh6/GHSA-qf9h-wvgw-cqh6.json b/advisories/unreviewed/2025/04/GHSA-qf9h-wvgw-cqh6/GHSA-qf9h-wvgw-cqh6.json
index 2078c67aa75..dd462430c49 100644
--- a/advisories/unreviewed/2025/04/GHSA-qf9h-wvgw-cqh6/GHSA-qf9h-wvgw-cqh6.json
+++ b/advisories/unreviewed/2025/04/GHSA-qf9h-wvgw-cqh6/GHSA-qf9h-wvgw-cqh6.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qf9h-wvgw-cqh6",
- "modified": "2025-04-10T15:31:43Z",
+ "modified": "2025-04-10T18:32:00Z",
"published": "2025-04-01T18:30:52Z",
"aliases": [
"CVE-2025-21941"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params\n\nNull pointer dereference issue could occur when pipe_ctx->plane_state\nis null. The fix adds a check to ensure 'pipe_ctx->plane_state' is not\nnull before accessing. This prevents a null pointer dereference.\n\nFound by code review.\n\n(cherry picked from commit 63e6a77ccf239337baa9b1e7787cde9fa0462092)",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -44,8 +49,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-476"
+ ],
+ "severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T16:15:24Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-qpfh-2wpm-c362/GHSA-qpfh-2wpm-c362.json b/advisories/unreviewed/2025/04/GHSA-qpfh-2wpm-c362/GHSA-qpfh-2wpm-c362.json
new file mode 100644
index 00000000000..82f93e247da
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-qpfh-2wpm-c362/GHSA-qpfh-2wpm-c362.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-qpfh-2wpm-c362",
+ "modified": "2025-04-10T18:32:03Z",
+ "published": "2025-04-10T18:32:02Z",
+ "aliases": [
+ "CVE-2025-22232"
+ ],
+ "details": "Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault.\nYour application may be affected by this if the following are true:\n * You have Spring Vault on the classpath of your Spring Cloud Config Server and\n * You are using the X-CONFIG-TOKEN header to send a Vault token to the Spring Cloud Config Server for the Config Server to use when making requests to Vault and\n * You are using the default Spring Vault SessionManager implementation LifecycleAwareSessionManager or a SessionManager implementation that persists the Vault token such as SimpleSessionManager.\n\nIn this case the SessionManager persists the first token it retrieves and will continue to use that token even if client requests to the Spring Cloud Config Server include a X-CONFIG-TOKEN header with a different value.\nAffected Spring Products and Versions\nSpring Cloud Config:\n * 2.2.1.RELEASE - 4.2.1\n\n\nMitigation\nUsers of affected versions should upgrade to the corresponding fixed version.\n\nAffected version(s)Fix versionAvailability4.2.x4.2.2OSS4.1.x4.1.6OSS4.0.x4.0.10Commercial3.1.x3.1.10Commercial3.0.x4.1.6OSS2.2.x4.1.6OSS\nNOTE: Spring Cloud Config 3.0.x and 2.2.x are no longer under open source or commercial support. Users of these versions are encouraged to upgrade to a supported version.\n\nNo other mitigation steps are necessary.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22232"
+ },
+ {
+ "type": "WEB",
+ "url": "https://spring.io/security/cve-2025-22232"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-287"
+ ],
+ "severity": "MODERATE",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-04-10T18:15:46Z"
+ }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/04/GHSA-r89f-5fp9-fmg7/GHSA-r89f-5fp9-fmg7.json b/advisories/unreviewed/2025/04/GHSA-r89f-5fp9-fmg7/GHSA-r89f-5fp9-fmg7.json
index 66e294ee834..832fc00f6f7 100644
--- a/advisories/unreviewed/2025/04/GHSA-r89f-5fp9-fmg7/GHSA-r89f-5fp9-fmg7.json
+++ b/advisories/unreviewed/2025/04/GHSA-r89f-5fp9-fmg7/GHSA-r89f-5fp9-fmg7.json
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r89f-5fp9-fmg7",
- "modified": "2025-04-01T18:30:52Z",
+ "modified": "2025-04-10T18:32:00Z",
"published": "2025-04-01T18:30:52Z",
"aliases": [
"CVE-2025-21929"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove()\n\nDuring the `rmmod` operation for the `intel_ishtp_hid` driver, a\nuse-after-free issue can occur in the hid_ishtp_cl_remove() function.\nThe function hid_ishtp_cl_deinit() is called before ishtp_hid_remove(),\nwhich can lead to accessing freed memory or resources during the\nremoval process.\n\nCall Trace:\n ? ishtp_cl_send+0x168/0x220 [intel_ishtp]\n ? hid_output_report+0xe3/0x150 [hid]\n hid_ishtp_set_feature+0xb5/0x120 [intel_ishtp_hid]\n ishtp_hid_request+0x7b/0xb0 [intel_ishtp_hid]\n hid_hw_request+0x1f/0x40 [hid]\n sensor_hub_set_feature+0x11f/0x190 [hid_sensor_hub]\n _hid_sensor_power_state+0x147/0x1e0 [hid_sensor_trigger]\n hid_sensor_runtime_resume+0x22/0x30 [hid_sensor_trigger]\n sensor_hub_remove+0xa8/0xe0 [hid_sensor_hub]\n hid_device_remove+0x49/0xb0 [hid]\n hid_destroy_device+0x6f/0x90 [hid]\n ishtp_hid_remove+0x42/0x70 [intel_ishtp_hid]\n hid_ishtp_cl_remove+0x6b/0xb0 [intel_ishtp_hid]\n ishtp_cl_device_remove+0x4a/0x60 [intel_ishtp]\n ...\n\nAdditionally, ishtp_hid_remove() is a HID level power off, which should\noccur before the ISHTP level disconnect.\n\nThis patch resolves the issue by reordering the calls in\nhid_ishtp_cl_remove(). The function ishtp_hid_remove() is now\ncalled before hid_ishtp_cl_deinit().",
- "severity": [],
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+ }
+ ],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
- "cwe_ids": [],
- "severity": null,
+ "cwe_ids": [
+ "CWE-416"
+ ],
+ "severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T16:15:23Z"
diff --git a/advisories/unreviewed/2025/04/GHSA-xfq9-hh5x-xfq9/GHSA-xfq9-hh5x-xfq9.json b/advisories/unreviewed/2025/04/GHSA-xfq9-hh5x-xfq9/GHSA-xfq9-hh5x-xfq9.json
new file mode 100644
index 00000000000..e8bcaec98b1
--- /dev/null
+++ b/advisories/unreviewed/2025/04/GHSA-xfq9-hh5x-xfq9/GHSA-xfq9-hh5x-xfq9.json
@@ -0,0 +1,36 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-xfq9-hh5x-xfq9",
+ "modified": "2025-04-10T18:32:03Z",
+ "published": "2025-04-10T18:32:03Z",
+ "aliases": [
+ "CVE-2025-24866"
+ ],
+ "details": "Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
+ }
+ ],
+ "affected": [],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24866"
+ },
+ {
+ "type": "WEB",
+ "url": "https://mattermost.com/security-updates"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-863"
+ ],
+ "severity": "LOW",
+ "github_reviewed": false,
+ "github_reviewed_at": null,
+ "nvd_published_at": "2025-04-10T16:15:27Z"
+ }
+}
\ No newline at end of file