Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-03-21 15:32:12 +00:00
parent 1a7249cfe9
commit 83c46ef46d
33 changed files with 628 additions and 56 deletions
@@ -1,24 +1,53 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-cg4p-5qfm-pjjj",
-  "modified": "2025-03-20T12:32:40Z",
+  "modified": "2025-03-21T15:30:34Z",
  "published": "2025-03-20T12:32:40Z",
  "aliases": [
    "CVE-2024-10713"
  ],
+  "summary": "HyperLPR Denial of Service vulnerability",
  "details": "A vulnerability in szad670401/hyperlpr v3.0 allows for a Denial of Service (DoS) attack. The server fails to handle excessive characters appended to the end of multipart boundaries, regardless of the character used. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary, leading to excessive resource consumption and a complete denial of service for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue.",
  "severity": [
    {
      "type": "CVSS_V3",
-      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "hyperlpr3"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "3.0"
+            }
+          ]
+        }
+      ]
    }
  ],
-  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10713"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/szad670401/HyperLPR/blob/9307450f7b7915be18f23a539ec05b41fe6629f4/Prj-Python/hyperlpr3/command/serve.py#L95"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/szad670401/hyperlpr"
+    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/d5404069-95b3-40e0-a7a4-c3a183d861b0"
@@ -29,8 +58,8 @@
      "CWE-400"
    ],
    "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-21T15:30:34Z",
    "nvd_published_at": "2025-03-20T10:15:18Z"
  }
 }
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-q7jg-7ww6-99x3",
-  "modified": "2025-03-20T15:30:23Z",
+  "modified": "2025-03-21T15:31:07Z",
  "published": "2022-05-24T16:56:04Z",
  "aliases": [
    "CVE-2019-16261"
@@ -23,6 +23,10 @@
      "type": "WEB",
      "url": "https://blog.korelogic.com/blog/2019/08/19/unpatched_fringe_infrastructure_bits"
    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/Shlucus/ab762d6b148f2d2d046c956526a80ddc"
+    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/Mar/1"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-cc6x-6938-549x",
-  "modified": "2022-09-18T00:00:35Z",
+  "modified": "2025-03-21T15:31:08Z",
  "published": "2022-09-14T00:00:42Z",
  "aliases": [
    "CVE-2022-38329"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-39h8-m6rh-4934",
-  "modified": "2023-02-24T18:30:27Z",
+  "modified": "2025-03-21T15:31:08Z",
  "published": "2023-02-13T03:30:28Z",
  "aliases": [
    "CVE-2023-22362"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8v9g-m6c6-6756",
-  "modified": "2023-02-27T15:30:22Z",
+  "modified": "2025-03-21T15:31:08Z",
  "published": "2023-02-13T03:30:29Z",
  "aliases": [
    "CVE-2023-22349"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mh2m-m37r-927m",
-  "modified": "2023-02-24T18:30:28Z",
+  "modified": "2025-03-21T15:31:08Z",
  "published": "2023-02-13T06:30:59Z",
  "aliases": [
    "CVE-2022-48323"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-v2q6-5m4m-pr58",
-  "modified": "2023-02-23T18:31:06Z",
+  "modified": "2025-03-21T15:31:09Z",
  "published": "2023-02-13T21:31:04Z",
  "aliases": [
    "CVE-2023-25719"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-wq4c-r2c3-fv9c",
-  "modified": "2023-02-15T18:30:21Z",
+  "modified": "2025-03-21T15:31:10Z",
  "published": "2023-02-14T00:30:20Z",
  "aliases": [
    "CVE-2023-0804"
@@ -35,6 +35,10 @@
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00026.html"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FBF3UUFSB6NB3NFTQSKOOIZGXJP3T34Z"
+    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FBF3UUFSB6NB3NFTQSKOOIZGXJP3T34Z"
@@ -53,7 +53,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-667"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -61,7 +61,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-908"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-qm5f-3c7g-gj8r",
-  "modified": "2025-02-27T06:30:53Z",
+  "modified": "2025-03-21T15:31:11Z",
  "published": "2025-02-27T06:30:53Z",
  "aliases": [
    "CVE-2024-13647"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-v793-w449-37r3",
-  "modified": "2025-02-16T06:31:45Z",
+  "modified": "2025-03-21T15:31:11Z",
  "published": "2025-02-16T06:31:45Z",
  "aliases": [
    "CVE-2024-57971"
@@ -27,6 +27,10 @@
      "type": "WEB",
      "url": "https://github.com/KnowageLabs/Knowage-Server/compare/v8.1.29...v8.1.30"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/darumaseye/CVEs/blob/ec2de9f7ecffde466e687745bfdfc672e86241d7/CVE-2024-57971.md"
+    },
    {
      "type": "WEB",
      "url": "https://spagobi.readthedocs.io"
@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4257-qx96-mgcq",
+  "modified": "2025-03-21T15:31:15Z",
+  "published": "2025-03-21T15:31:15Z",
+  "aliases": [
+    "CVE-2024-57490"
+  ],
+  "details": "Guangzhou Hongfan Technology Co., LTD. iOffice20 has any user login vulnerability. An attacker can log in to any system account including the system administrator through a logical flaw.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57490"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/NaliangzzZ/44bfcc1d9c2cf275d2b6683ca9e20980"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ioffice.cn"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-21T14:15:15Z"
+  }
+}
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5rfm-vp96-44gv",
-  "modified": "2025-03-18T15:30:49Z",
+  "modified": "2025-03-21T15:31:13Z",
  "published": "2025-03-18T15:30:49Z",
  "aliases": [
    "CVE-2025-30113"
  ],
  "details": "An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Hardcoded Credentials exist in the APK for Ports 9091 and 9092. The dashcam's Android application contains hardcoded credentials that allow unauthorized access to device settings through ports 9091 and 9092. These credentials, stored in cleartext, can be exploited by an attacker who gains access to the dashcam's network.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -24,8 +29,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-798"
+    ],
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-18T15:16:02Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-6f67-378m-2772",
-  "modified": "2025-03-17T21:30:34Z",
+  "modified": "2025-03-21T15:31:13Z",
  "published": "2025-03-17T21:30:34Z",
  "aliases": [
    "CVE-2024-54559"
  ],
  "details": "The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-17T20:15:13Z"
@@ -0,0 +1,64 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6q3p-m444-94qp",
+  "modified": "2025-03-21T15:31:15Z",
+  "published": "2025-03-21T15:31:15Z",
+  "aliases": [
+    "CVE-2025-2591"
+  ],
+  "details": "A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd. It is recommended to apply a patch to fix this issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2591"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/assimp/assimp/issues/6009"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/assimp/assimp/issues/6009#issue-2877367021"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/assimp/assimp/pull/6047"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/assimp/assimp/pull/6047/commits/ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.300574"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.300574"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.517781"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-369"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-21T14:15:16Z"
+  }
+}
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7mhp-jcj6-vjwp",
+  "modified": "2025-03-21T15:31:15Z",
+  "published": "2025-03-21T15:31:15Z",
+  "aliases": [
+    "CVE-2025-29641"
+  ],
+  "details": "Phpgurukul Vehicle Record Management System v1.0 is vulnerable to SQL Injection in /index.php via the 'searchinputdata' parameter.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29641"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Pei4AN/CVE/issues/5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-21T15:15:42Z"
+  }
+}
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-82gg-jm8m-39w6",
-  "modified": "2025-03-18T15:30:50Z",
+  "modified": "2025-03-21T15:31:14Z",
  "published": "2025-03-18T15:30:50Z",
  "aliases": [
    "CVE-2025-30115"
  ],
  "details": "An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It uses a fixed default SSID and password (\"qwertyuiop\"), which cannot be modified by users. The SSID is continuously broadcast, allowing unauthorized access to the device network.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -24,8 +29,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-259"
+    ],
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-18T15:16:02Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-938x-rjx9-c9f3",
-  "modified": "2025-03-14T09:34:06Z",
+  "modified": "2025-03-21T15:31:12Z",
  "published": "2025-03-14T09:34:06Z",
  "aliases": [
    "CVE-2025-2221"
--- a/Show More
+++ b/Show More