From 9188be2092ff5f53ca3305ccee6f4dd389012492 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 9 Apr 2025 12:32:22 +0000 Subject: [PATCH] Publish Advisories GHSA-4m6f-v755-rgh3 GHSA-g3pr-2xqq-vj3c GHSA-gjx9-wg9x-7gvp GHSA-gmg8-593g-7mv3 GHSA-m2c9-v8xf-797h GHSA-pj4r-9g32-mjr7 GHSA-qmgj-5w5x-25gc GHSA-rcqj-3fmp-5cqx GHSA-vv3m-5756-qf6f --- .../GHSA-4m6f-v755-rgh3.json | 48 +++++++++++++++++++ .../GHSA-g3pr-2xqq-vj3c.json | 40 ++++++++++++++++ .../GHSA-gjx9-wg9x-7gvp.json | 29 +++++++++++ .../GHSA-gmg8-593g-7mv3.json | 35 ++++++++++++++ .../GHSA-m2c9-v8xf-797h.json | 40 ++++++++++++++++ .../GHSA-pj4r-9g32-mjr7.json | 40 ++++++++++++++++ .../GHSA-qmgj-5w5x-25gc.json | 40 ++++++++++++++++ .../GHSA-rcqj-3fmp-5cqx.json | 40 ++++++++++++++++ .../GHSA-vv3m-5756-qf6f.json | 40 ++++++++++++++++ 9 files changed, 352 insertions(+) create mode 100644 advisories/unreviewed/2025/04/GHSA-4m6f-v755-rgh3/GHSA-4m6f-v755-rgh3.json create mode 100644 advisories/unreviewed/2025/04/GHSA-g3pr-2xqq-vj3c/GHSA-g3pr-2xqq-vj3c.json create mode 100644 advisories/unreviewed/2025/04/GHSA-gjx9-wg9x-7gvp/GHSA-gjx9-wg9x-7gvp.json create mode 100644 advisories/unreviewed/2025/04/GHSA-gmg8-593g-7mv3/GHSA-gmg8-593g-7mv3.json create mode 100644 advisories/unreviewed/2025/04/GHSA-m2c9-v8xf-797h/GHSA-m2c9-v8xf-797h.json create mode 100644 advisories/unreviewed/2025/04/GHSA-pj4r-9g32-mjr7/GHSA-pj4r-9g32-mjr7.json create mode 100644 advisories/unreviewed/2025/04/GHSA-qmgj-5w5x-25gc/GHSA-qmgj-5w5x-25gc.json create mode 100644 advisories/unreviewed/2025/04/GHSA-rcqj-3fmp-5cqx/GHSA-rcqj-3fmp-5cqx.json create mode 100644 advisories/unreviewed/2025/04/GHSA-vv3m-5756-qf6f/GHSA-vv3m-5756-qf6f.json diff --git a/advisories/unreviewed/2025/04/GHSA-4m6f-v755-rgh3/GHSA-4m6f-v755-rgh3.json b/advisories/unreviewed/2025/04/GHSA-4m6f-v755-rgh3/GHSA-4m6f-v755-rgh3.json new file mode 100644 index 00000000000..91ed325bb0d --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-4m6f-v755-rgh3/GHSA-4m6f-v755-rgh3.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4m6f-v755-rgh3", + "modified": "2025-04-09T12:30:24Z", + "published": "2025-04-09T12:30:24Z", + "aliases": [ + "CVE-2017-20197" + ], + "details": "A vulnerability was found in propanetank Roommate-Bill-Tracking up to 288437f658fc9ee7d4b92a9da12557024d8bc55c. It has been declared as critical. This vulnerability affects unknown code of the file /includes/login.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The name of the patch is b32bb1b940f82d38fb9310cd66ebe349e20a1d0a. It is recommended to apply a patch to fix this issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20197" + }, + { + "type": "WEB", + "url": "https://github.com/propanetank/Roommate-Bill-Tracking/commit/b32bb1b940f82d38fb9310cd66ebe349e20a1d0a" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303640" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303640" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-09T11:15:40Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-g3pr-2xqq-vj3c/GHSA-g3pr-2xqq-vj3c.json b/advisories/unreviewed/2025/04/GHSA-g3pr-2xqq-vj3c/GHSA-g3pr-2xqq-vj3c.json new file mode 100644 index 00000000000..d912ad66d83 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-g3pr-2xqq-vj3c/GHSA-g3pr-2xqq-vj3c.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g3pr-2xqq-vj3c", + "modified": "2025-04-09T12:30:24Z", + "published": "2025-04-09T12:30:24Z", + "aliases": [ + "CVE-2025-2222" + ], + "details": "CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak\ninformation and potential privilege escalation following man in the middle attack.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2222" + }, + { + "type": "WEB", + "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-01.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-552" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-09T11:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-gjx9-wg9x-7gvp/GHSA-gjx9-wg9x-7gvp.json b/advisories/unreviewed/2025/04/GHSA-gjx9-wg9x-7gvp/GHSA-gjx9-wg9x-7gvp.json new file mode 100644 index 00000000000..3e9c9ce99bc --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-gjx9-wg9x-7gvp/GHSA-gjx9-wg9x-7gvp.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gjx9-wg9x-7gvp", + "modified": "2025-04-09T12:30:24Z", + "published": "2025-04-09T12:30:24Z", + "aliases": [ + "CVE-2025-29189" + ], + "details": "Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29189" + }, + { + "type": "WEB", + "url": "https://drive.google.com/file/d/1WHPslTmQmAM9xPJifULS2qAo7hcidB4L/view?usp=sharing" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-09T12:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-gmg8-593g-7mv3/GHSA-gmg8-593g-7mv3.json b/advisories/unreviewed/2025/04/GHSA-gmg8-593g-7mv3/GHSA-gmg8-593g-7mv3.json new file mode 100644 index 00000000000..254e936b664 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-gmg8-593g-7mv3/GHSA-gmg8-593g-7mv3.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gmg8-593g-7mv3", + "modified": "2025-04-09T12:30:24Z", + "published": "2025-04-09T12:30:24Z", + "aliases": [ + "CVE-2025-31672" + ], + "details": "Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (including the path) in the zip. In this case, products reading the affected file could read different data because 1 of the zip entries with the duplicate name is selected over another but different products may choose a different zip entry.\nThis issue affects Apache POI poi-ooxml before 5.4.0. poi-ooxml 5.4.0 has a check that throws an exception if zip entries with duplicate file names are found in the input file.\nUsers are recommended to upgrade to version poi-ooxml 5.4.0, which fixes the issue. Please read https://poi.apache.org/security.html for recommendations about how to use the POI libraries securely.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31672" + }, + { + "type": "WEB", + "url": "https://bz.apache.org/bugzilla/show_bug.cgi?id=69620" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/k14w8vcjqy4h34hh5kzldko78kpylkq5" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-09T12:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-m2c9-v8xf-797h/GHSA-m2c9-v8xf-797h.json b/advisories/unreviewed/2025/04/GHSA-m2c9-v8xf-797h/GHSA-m2c9-v8xf-797h.json new file mode 100644 index 00000000000..081d39c4521 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-m2c9-v8xf-797h/GHSA-m2c9-v8xf-797h.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m2c9-v8xf-797h", + "modified": "2025-04-09T12:30:24Z", + "published": "2025-04-09T12:30:24Z", + "aliases": [ + "CVE-2025-2441" + ], + "details": "CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of\nconfidentiality when a malicious user, having physical access, sets the radio in factory default mode where the\nproduct does not correctly initialize all data.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2441" + }, + { + "type": "WEB", + "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-02.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1188" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-09T11:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-pj4r-9g32-mjr7/GHSA-pj4r-9g32-mjr7.json b/advisories/unreviewed/2025/04/GHSA-pj4r-9g32-mjr7/GHSA-pj4r-9g32-mjr7.json new file mode 100644 index 00000000000..d497f03c035 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-pj4r-9g32-mjr7/GHSA-pj4r-9g32-mjr7.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pj4r-9g32-mjr7", + "modified": "2025-04-09T12:30:24Z", + "published": "2025-04-09T12:30:24Z", + "aliases": [ + "CVE-2025-2223" + ], + "details": "CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and\nAvailability of engineering workstation when a malicious project file is loaded by a user from the local system.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2223" + }, + { + "type": "WEB", + "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-01.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-09T11:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-qmgj-5w5x-25gc/GHSA-qmgj-5w5x-25gc.json b/advisories/unreviewed/2025/04/GHSA-qmgj-5w5x-25gc/GHSA-qmgj-5w5x-25gc.json new file mode 100644 index 00000000000..f2e6c9b73d3 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-qmgj-5w5x-25gc/GHSA-qmgj-5w5x-25gc.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qmgj-5w5x-25gc", + "modified": "2025-04-09T12:30:24Z", + "published": "2025-04-09T12:30:24Z", + "aliases": [ + "CVE-2025-2442" + ], + "details": "CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to\nunauthorized access which could result in the loss of confidentially, integrity and availability when a malicious\nuser, having physical access, sets the radio to the factory default mode.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2442" + }, + { + "type": "WEB", + "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-02.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1188" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-09T11:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-rcqj-3fmp-5cqx/GHSA-rcqj-3fmp-5cqx.json b/advisories/unreviewed/2025/04/GHSA-rcqj-3fmp-5cqx/GHSA-rcqj-3fmp-5cqx.json new file mode 100644 index 00000000000..7a07f9f3533 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-rcqj-3fmp-5cqx/GHSA-rcqj-3fmp-5cqx.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rcqj-3fmp-5cqx", + "modified": "2025-04-09T12:30:24Z", + "published": "2025-04-09T12:30:24Z", + "aliases": [ + "CVE-2025-30677" + ], + "details": "Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs.\n\n\nThis vulnerability can lead to unintended exposure of credentials in log files, potentially allowing attackers with access to these logs to obtain Apache Kafka credentials. The vulnerability's impact is limited by the fact that an attacker would need access to the application logs to exploit this issue.\n\nThis issue affects Apache Pulsar IO's Apache Kafka connectors in all versions before 3.0.11, 3.3.6, and 4.0.4.\n\n\n3.0.x version users should upgrade to at least 3.0.11.\n\n3.3.x version users should upgrade to at least 3.3.6.\n\n4.0.x version users should upgrade to at least 4.0.4.\n\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30677" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/zv5fwwrh374r1p5cmksxcd40ssxxko3d" + }, + { + "type": "WEB", + "url": "https://pulsar.apache.org/security" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-09T12:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-vv3m-5756-qf6f/GHSA-vv3m-5756-qf6f.json b/advisories/unreviewed/2025/04/GHSA-vv3m-5756-qf6f/GHSA-vv3m-5756-qf6f.json new file mode 100644 index 00000000000..cbd6767ac60 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-vv3m-5756-qf6f/GHSA-vv3m-5756-qf6f.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vv3m-5756-qf6f", + "modified": "2025-04-09T12:30:24Z", + "published": "2025-04-09T12:30:24Z", + "aliases": [ + "CVE-2025-2440" + ], + "details": "CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized\naccess of confidential data when a malicious user, having physical access and advanced information on the file\nsystem, sets the radio in factory default mode.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2440" + }, + { + "type": "WEB", + "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-02.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-922" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-09T11:15:42Z" + } +} \ No newline at end of file