diff --git a/advisories/unreviewed/2024/08/GHSA-5wvf-7fq8-m4w6/GHSA-5wvf-7fq8-m4w6.json b/advisories/unreviewed/2024/08/GHSA-5wvf-7fq8-m4w6/GHSA-5wvf-7fq8-m4w6.json index d482b3160cf..bb9974c27f4 100644 --- a/advisories/unreviewed/2024/08/GHSA-5wvf-7fq8-m4w6/GHSA-5wvf-7fq8-m4w6.json +++ b/advisories/unreviewed/2024/08/GHSA-5wvf-7fq8-m4w6/GHSA-5wvf-7fq8-m4w6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5wvf-7fq8-m4w6", - "modified": "2024-10-10T18:31:08Z", + "modified": "2025-03-17T09:31:01Z", "published": "2024-08-07T12:31:28Z", "aliases": [ "CVE-2024-7266" @@ -27,10 +27,18 @@ "type": "WEB", "url": "https://cert.pl/en/posts/2024/08/CVE-2023-7265" }, + { + "type": "WEB", + "url": "https://cert.pl/en/posts/2024/08/CVE-2024-7265" + }, { "type": "WEB", "url": "https://cert.pl/posts/2024/08/CVE-2023-7265" }, + { + "type": "WEB", + "url": "https://cert.pl/posts/2024/08/CVE-2024-7265" + }, { "type": "WEB", "url": "https://www.gov.pl/web/ezd-rp" diff --git a/advisories/unreviewed/2024/08/GHSA-cq2c-35gp-j9qc/GHSA-cq2c-35gp-j9qc.json b/advisories/unreviewed/2024/08/GHSA-cq2c-35gp-j9qc/GHSA-cq2c-35gp-j9qc.json index 792c5c21708..38181ef8032 100644 --- a/advisories/unreviewed/2024/08/GHSA-cq2c-35gp-j9qc/GHSA-cq2c-35gp-j9qc.json +++ b/advisories/unreviewed/2024/08/GHSA-cq2c-35gp-j9qc/GHSA-cq2c-35gp-j9qc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-cq2c-35gp-j9qc", - "modified": "2024-08-23T15:30:33Z", + "modified": "2025-03-17T09:31:01Z", "published": "2024-08-07T12:31:28Z", "aliases": [ "CVE-2024-7267" @@ -27,10 +27,18 @@ "type": "WEB", "url": "https://cert.pl/en/posts/2024/08/CVE-2023-7265" }, + { + "type": "WEB", + "url": "https://cert.pl/en/posts/2024/08/CVE-2024-7265" + }, { "type": "WEB", "url": "https://cert.pl/posts/2024/08/CVE-2023-7265" }, + { + "type": "WEB", + "url": "https://cert.pl/posts/2024/08/CVE-2024-7265" + }, { "type": "WEB", "url": "https://www.gov.pl/web/ezd-rp" diff --git a/advisories/unreviewed/2024/08/GHSA-jvvm-gq28-8rgc/GHSA-jvvm-gq28-8rgc.json b/advisories/unreviewed/2024/08/GHSA-jvvm-gq28-8rgc/GHSA-jvvm-gq28-8rgc.json index 1e13fa89212..a6ca1829b25 100644 --- a/advisories/unreviewed/2024/08/GHSA-jvvm-gq28-8rgc/GHSA-jvvm-gq28-8rgc.json +++ b/advisories/unreviewed/2024/08/GHSA-jvvm-gq28-8rgc/GHSA-jvvm-gq28-8rgc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jvvm-gq28-8rgc", - "modified": "2024-10-10T18:31:08Z", + "modified": "2025-03-17T09:31:01Z", "published": "2024-08-07T12:31:28Z", "aliases": [ "CVE-2024-7265" @@ -27,10 +27,18 @@ "type": "WEB", "url": "https://cert.pl/en/posts/2024/08/CVE-2023-7265" }, + { + "type": "WEB", + "url": "https://cert.pl/en/posts/2024/08/CVE-2024-7265" + }, { "type": "WEB", "url": "https://cert.pl/posts/2024/08/CVE-2023-7265" }, + { + "type": "WEB", + "url": "https://cert.pl/posts/2024/08/CVE-2024-7265" + }, { "type": "WEB", "url": "https://www.gov.pl/web/ezd-rp" diff --git a/advisories/unreviewed/2025/03/GHSA-4f9q-7x9g-3vmq/GHSA-4f9q-7x9g-3vmq.json b/advisories/unreviewed/2025/03/GHSA-4f9q-7x9g-3vmq/GHSA-4f9q-7x9g-3vmq.json new file mode 100644 index 00000000000..397e1d1cbfd --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-4f9q-7x9g-3vmq/GHSA-4f9q-7x9g-3vmq.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4f9q-7x9g-3vmq", + "modified": "2025-03-17T09:31:02Z", + "published": "2025-03-17T09:31:01Z", + "aliases": [ + "CVE-2025-1724" + ], + "details": "Zohocorp's ManageEngine Analytics Plus and Zoho Analytics on-premise versions older than 6130 are vulnerable to an AD only account takeover because of a hardcoded sensitive token.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1724" + }, + { + "type": "WEB", + "url": "https://www.manageengine.com/analytics-plus/CVE-2025-1724.html" + }, + { + "type": "WEB", + "url": "https://www.zoho.com/analytics/onpremise/CVE-2025-1724.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-798" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-17T07:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-4qcq-c33q-9hm3/GHSA-4qcq-c33q-9hm3.json b/advisories/unreviewed/2025/03/GHSA-4qcq-c33q-9hm3/GHSA-4qcq-c33q-9hm3.json new file mode 100644 index 00000000000..9be5f34c7fb --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-4qcq-c33q-9hm3/GHSA-4qcq-c33q-9hm3.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4qcq-c33q-9hm3", + "modified": "2025-03-17T09:31:02Z", + "published": "2025-03-17T09:31:02Z", + "aliases": [ + "CVE-2025-2370" + ], + "details": "A vulnerability was found in TOTOLINK EX1800T up to 9.1.0cu.2112_B20220316. It has been declared as critical. Affected by this vulnerability is the function setWiFiExtenderConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument apcliSsid leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2370" + }, + { + "type": "WEB", + "url": "https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/Stack-based%20Buffer%20Overflow%2003%20setWiFiExtenderConfig-_apcliSsid.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299869" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299869" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.515329" + }, + { + "type": "WEB", + "url": "https://www.totolink.net" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-17T09:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-f624-74px-f7hv/GHSA-f624-74px-f7hv.json b/advisories/unreviewed/2025/03/GHSA-f624-74px-f7hv/GHSA-f624-74px-f7hv.json new file mode 100644 index 00000000000..eb9b09364d4 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-f624-74px-f7hv/GHSA-f624-74px-f7hv.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f624-74px-f7hv", + "modified": "2025-03-17T09:31:02Z", + "published": "2025-03-17T09:31:02Z", + "aliases": [ + "CVE-2025-2369" + ], + "details": "A vulnerability was found in TOTOLINK EX1800T up to 9.1.0cu.2112_B20220316. It has been classified as critical. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument admpass leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2369" + }, + { + "type": "WEB", + "url": "https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/Stack-based%20Buffer%20Overflow%2002%20setPasswordCfg-_admpass.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299868" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299868" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.515328" + }, + { + "type": "WEB", + "url": "https://www.totolink.net" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-17T09:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-jmhw-jx5q-8q6h/GHSA-jmhw-jx5q-8q6h.json b/advisories/unreviewed/2025/03/GHSA-jmhw-jx5q-8q6h/GHSA-jmhw-jx5q-8q6h.json new file mode 100644 index 00000000000..f1c65e1756a --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-jmhw-jx5q-8q6h/GHSA-jmhw-jx5q-8q6h.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jmhw-jx5q-8q6h", + "modified": "2025-03-17T09:31:02Z", + "published": "2025-03-17T09:31:02Z", + "aliases": [ + "CVE-2025-2366" + ], + "details": "A vulnerability, which was classified as problematic, was found in gougucms 4.08.18. This affects the function add of the file /admin/department/add of the component Add Department Page. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2366" + }, + { + "type": "WEB", + "url": "https://github.com/caigo8/CVE-md/blob/main/gougucms/gougucms_v4.08.18_XSS.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299865" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299865" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.515044" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-17T07:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-mrvw-4m65-76p9/GHSA-mrvw-4m65-76p9.json b/advisories/unreviewed/2025/03/GHSA-mrvw-4m65-76p9/GHSA-mrvw-4m65-76p9.json new file mode 100644 index 00000000000..28606b99129 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-mrvw-4m65-76p9/GHSA-mrvw-4m65-76p9.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mrvw-4m65-76p9", + "modified": "2025-03-17T09:31:02Z", + "published": "2025-03-17T09:31:02Z", + "aliases": [ + "CVE-2025-2367" + ], + "details": "A vulnerability has been found in Oiwtech OIW-2431APGN-HP 2.5.3-B20131128 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formScript of the component Personal Script Submenu. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2367" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299866" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299866" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.515126" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-17T08:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-rqch-2mmw-28wc/GHSA-rqch-2mmw-28wc.json b/advisories/unreviewed/2025/03/GHSA-rqch-2mmw-28wc/GHSA-rqch-2mmw-28wc.json new file mode 100644 index 00000000000..5507dfa353c --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-rqch-2mmw-28wc/GHSA-rqch-2mmw-28wc.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rqch-2mmw-28wc", + "modified": "2025-03-17T09:31:02Z", + "published": "2025-03-17T09:31:02Z", + "aliases": [ + "CVE-2025-2368" + ], + "details": "A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2368" + }, + { + "type": "WEB", + "url": "https://github.com/WebAssembly/wabt/issues/2537" + }, + { + "type": "WEB", + "url": "https://github.com/WebAssembly/wabt/issues/2556" + }, + { + "type": "WEB", + "url": "https://github.com/WebAssembly/wabt/issues/2556#issue-2899598349" + }, + { + "type": "WEB", + "url": "https://github.com/WebAssembly/wabt/pull/2541" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299867" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299867" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.515327" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-17T08:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-vpv2-qq64-v6hh/GHSA-vpv2-qq64-v6hh.json b/advisories/unreviewed/2025/03/GHSA-vpv2-qq64-v6hh/GHSA-vpv2-qq64-v6hh.json new file mode 100644 index 00000000000..ed5d9d37b3e --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-vpv2-qq64-v6hh/GHSA-vpv2-qq64-v6hh.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vpv2-qq64-v6hh", + "modified": "2025-03-17T09:31:02Z", + "published": "2025-03-17T09:31:02Z", + "aliases": [ + "CVE-2025-2365" + ], + "details": "A vulnerability, which was classified as problematic, has been found in crmeb_java up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2365" + }, + { + "type": "WEB", + "url": "https://github.com/jmx0hxq/Vulnerability-learning/blob/main/crmeb-java-xxe1.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299864" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299864" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.513285" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-610" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-17T07:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-ww28-ppvp-m3hj/GHSA-ww28-ppvp-m3hj.json b/advisories/unreviewed/2025/03/GHSA-ww28-ppvp-m3hj/GHSA-ww28-ppvp-m3hj.json new file mode 100644 index 00000000000..71b006f44a3 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-ww28-ppvp-m3hj/GHSA-ww28-ppvp-m3hj.json @@ -0,0 +1,25 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ww28-ppvp-m3hj", + "modified": "2025-03-17T09:31:01Z", + "published": "2025-03-17T09:31:01Z", + "aliases": [ + "CVE-2023-52315" + ], + "details": "Rejected reason: withdraw", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52315" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-17T07:15:33Z" + } +} \ No newline at end of file