netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3gc7-fjrx-p6mg
GHSA-4vjr-hfpp-2m7w
GHSA-fq5x-7292-2p5r
This commit is contained in:
advisory-database[bot]
2025-04-04 18:24:43 +00:00
parent 24196e4805
commit 915114fe6b
3 changed files with 92 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/04/GHSA-3gc7-fjrx-p6mg/GHSA-3gc7-fjrx-p6mg.json → advisories/github-reviewed/2025/04/GHSA-3gc7-fjrx-p6mg/GHSA-3gc7-fjrx-p6mg.json
+31 -6
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3gc7-fjrx-p6mg",
"modified": "2025-04-04T06:34:23Z",
"modified": "2025-04-04T18:23:45Z",
"published": "2025-04-04T06:34:22Z",
"aliases": [
"CVE-2025-3194"
],
"details": "Versions of the package bigint-buffer from 0.0.0 are vulnerable to Buffer Overflow in the toBigIntLE() function. Attackers can exploit this to crash the application.",
"summary": "bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function",
"details": "Versions of the package bigint-buffer from 0.0.0 to 1.1.5 are vulnerable to Buffer Overflow in the toBigIntLE() function. Attackers can exploit this to crash the application.",
"severity": [
{
"type": "CVSS_V3",
@@ -17,15 +18,39 @@
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "bigint-buffer"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3194"
},
{
"type": "PACKAGE",
"url": "https://github.com/no2chem/bigint-buffer"
},
{
"type": "WEB",
"url": "https://github.com/no2chem/bigint-buffer/blob/master/src/index.ts%23L25"
"url": "https://github.com/no2chem/bigint-buffer/blob/master/src/index.ts#L25"
},
{
"type": "WEB",
@@ -41,8 +66,8 @@
"CWE-120"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-04T18:23:45Z",
"nvd_published_at": "2025-04-04T05:15:45Z"
}
}
advisories/unreviewed/2025/04/GHSA-4vjr-hfpp-2m7w/GHSA-4vjr-hfpp-2m7w.json → advisories/github-reviewed/2025/04/GHSA-4vjr-hfpp-2m7w/GHSA-4vjr-hfpp-2m7w.json
+31 -6
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4vjr-hfpp-2m7w",
"modified": "2025-04-04T06:34:23Z",
"modified": "2025-04-04T18:24:05Z",
"published": "2025-04-04T06:34:23Z",
"aliases": [
"CVE-2025-3197"
],
"details": "Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.",
"summary": "expand-object Vulnerable to Prototype Pollution via the expand() Function",
"details": "Versions of the package expand-object from 0.0.0 to 0.4.2 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.",
"severity": [
{
"type": "CVSS_V3",
@@ -17,7 +18,27 @@
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "expand-object"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.4.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -27,9 +48,13 @@
"type": "WEB",
"url": "https://gist.github.com/miguelafmonteiro/d8f66af61d14e06338b688f90c4dfa7c"
},
{
"type": "PACKAGE",
"url": "https://github.com/jonschlinkert/expand-object"
},
{
"type": "WEB",
"url": "https://github.com/jonschlinkert/expand-object/blob/master/index.js%23L13"
"url": "https://github.com/jonschlinkert/expand-object/blob/master/index.js#L13"
},
{
"type": "WEB",
@@ -41,8 +66,8 @@
"CWE-1321"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-04T18:24:05Z",
"nvd_published_at": "2025-04-04T05:15:46Z"
}
}
advisories/unreviewed/2025/04/GHSA-fq5x-7292-2p5r/GHSA-fq5x-7292-2p5r.json → advisories/github-reviewed/2025/04/GHSA-fq5x-7292-2p5r/GHSA-fq5x-7292-2p5r.json
+30 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fq5x-7292-2p5r",
"modified": "2025-04-04T06:34:22Z",
"modified": "2025-04-04T18:23:07Z",
"published": "2025-04-04T06:34:22Z",
"aliases": [
"CVE-2025-3191"
],
"summary": "React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button",
"details": "All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the <iframe> tag.",
"severity": [
{
@@ -17,7 +18,27 @@
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "react-draft-wysiwyg"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.15.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -27,6 +48,10 @@
"type": "WEB",
"url": "https://gist.github.com/th4s1s/175ae4b2632096059b42377dd6c49d47"
},
{
"type": "PACKAGE",
"url": "https://github.com/jpuri/react-draft-wysiwyg"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-REACTDRAFTWYSIWYG-8515884"
@@ -36,9 +61,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2025-04-04T18:23:07Z",
"nvd_published_at": "2025-04-04T05:15:45Z"
}
}