mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-58c2-r57v-99r7 GHSA-2gj6-9934-w9r6 GHSA-9f57-9rhg-4hvm GHSA-ghgv-34p7-4r7x GHSA-hrqm-vf6v-j4gp GHSA-hvqq-hwj3-c54m GHSA-m6hh-vp2v-rm5m GHSA-mv3w-32c3-rrg8 GHSA-pcg9-hhvc-mjj6 GHSA-vxm9-8mfw-vc6g
This commit is contained in:
advisory-database[bot]
@@ -1,13 +1,18 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-58c2-r57v-99r7",
|
||||
"modified": "2022-03-03T00:00:57Z",
|
||||
"modified": "2025-02-20T03:32:03Z",
|
||||
"published": "2022-02-25T00:01:07Z",
|
||||
"aliases": [
|
||||
"CVE-2021-44967"
|
||||
],
|
||||
"details": "A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file.",
|
||||
"severity": [],
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
@@ -21,6 +26,10 @@
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.exploit-db.com/exploits/50573"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.limesurvey.org/manual/Plugins_-_advanced"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2gj6-9934-w9r6",
|
||||
"modified": "2025-02-07T09:31:51Z",
|
||||
"modified": "2025-02-20T03:32:03Z",
|
||||
"published": "2024-12-04T06:31:02Z",
|
||||
"aliases": [
|
||||
"CVE-2024-9404"
|
||||
@@ -30,6 +30,10 @@
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240931-cve-2024-9404-denial-of-service-vulnerability-identified-in-multiple-eds,-ics,-iks,-and-sds-switches"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240933-cve-2024-9404-denial-of-service-vulnerability-identified-in-multiple-pt-switches"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-9f57-9rhg-4hvm",
|
||||
"modified": "2025-02-20T03:32:03Z",
|
||||
"published": "2025-02-20T03:32:03Z",
|
||||
"aliases": [
|
||||
"CVE-2025-23020"
|
||||
],
|
||||
"details": "An issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23020"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/ptrd/kwik/releases/tag/v0.10.1"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-407"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-02-20T03:15:12Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-ghgv-34p7-4r7x",
|
||||
"modified": "2025-02-20T03:32:03Z",
|
||||
"published": "2025-02-20T03:32:03Z",
|
||||
"aliases": [
|
||||
"CVE-2025-24947"
|
||||
],
|
||||
"details": "A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This is caused by XXH32 usage.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24947"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/litespeedtech/lsquic/releases/tag/v4.2.0"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://xxhash.com"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-407"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-02-20T03:15:12Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-hrqm-vf6v-j4gp",
|
||||
"modified": "2025-02-20T03:32:03Z",
|
||||
"published": "2025-02-20T03:32:03Z",
|
||||
"aliases": [
|
||||
"CVE-2025-1492"
|
||||
],
|
||||
"details": "Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via packet injection or crafted capture file",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1492"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://gitlab.com/wireshark/wireshark/-/issues/20373"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.wireshark.org/security/wnpa-sec-2025-01.html"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-674"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-02-20T02:15:38Z"
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-hvqq-hwj3-c54m",
|
||||
"modified": "2025-02-19T18:32:20Z",
|
||||
"modified": "2025-02-20T03:32:03Z",
|
||||
"published": "2025-02-12T21:31:53Z",
|
||||
"aliases": [
|
||||
"CVE-2025-0108"
|
||||
@@ -23,9 +23,33 @@
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0108"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/iSee857/CVE-2025-0108-PoC"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2025-0108"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.bleepingcomputer.com/news/security/palo-alto-networks-tags-new-firewall-bug-as-exploited-in-attacks"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wild"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.securityweek.com/palo-alto-networks-confirms-exploitation-of-firewall-vulnerability"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.theregister.com/2025/02/19/palo_alto_firewall_attack"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-m6hh-vp2v-rm5m",
|
||||
"modified": "2025-02-20T03:32:03Z",
|
||||
"published": "2025-02-20T03:32:03Z",
|
||||
"aliases": [
|
||||
"CVE-2025-24946"
|
||||
],
|
||||
"details": "The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24946"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/private-octopus/picoquic/commit/b80fd3f5903279ae3e7714ee4109363d9ab4491a"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-407"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-02-20T03:15:12Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-mv3w-32c3-rrg8",
|
||||
"modified": "2025-02-20T03:32:03Z",
|
||||
"published": "2025-02-20T03:32:03Z",
|
||||
"aliases": [
|
||||
"CVE-2025-1222"
|
||||
],
|
||||
"details": "An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1222"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://support.citrix.com/s/article/CTX692679-citrix-secure-access-client-for-mac-security-bulletin-for-cve20251222-and-cve20251223?language=en_US"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-02-20T01:15:09Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-pcg9-hhvc-mjj6",
|
||||
"modified": "2025-02-20T03:32:03Z",
|
||||
"published": "2025-02-20T03:32:03Z",
|
||||
"aliases": [
|
||||
"CVE-2025-1223"
|
||||
],
|
||||
"details": "An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1223"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://support.citrix.com/s/article/CTX692679-citrix-secure-access-client-for-mac-security-bulletin-for-cve20251222-and-cve20251223?language=en_US"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-427"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-02-20T01:15:09Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-vxm9-8mfw-vc6g",
|
||||
"modified": "2025-02-20T03:32:03Z",
|
||||
"published": "2025-02-20T03:32:03Z",
|
||||
"aliases": [
|
||||
"CVE-2025-1293"
|
||||
],
|
||||
"details": "Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1293"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://discuss.hashicorp.com/t/hcsec-2025-03-hashicorp-hermes-improperly-validates-aws-alb-jwts-which-may-lead-to-authentication-bypass/73371"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-1390"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-02-20T01:15:09Z"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user