diff --git a/advisories/unreviewed/2025/03/GHSA-2gqq-g5xg-qr37/GHSA-2gqq-g5xg-qr37.json b/advisories/unreviewed/2025/03/GHSA-2gqq-g5xg-qr37/GHSA-2gqq-g5xg-qr37.json new file mode 100644 index 00000000000..d1f5b08ac38 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-2gqq-g5xg-qr37/GHSA-2gqq-g5xg-qr37.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2gqq-g5xg-qr37", + "modified": "2025-03-11T09:30:30Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2025-2174" + ], + "details": "A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "WEB", + "url": "https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2174" + }, + { + "type": "WEB", + "url": "https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f" + }, + { + "type": "WEB", + "url": "https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299203" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299203" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.512800" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T07:15:36Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-43mj-4x9x-534w/GHSA-43mj-4x9x-534w.json b/advisories/unreviewed/2025/03/GHSA-43mj-4x9x-534w/GHSA-43mj-4x9x-534w.json new file mode 100644 index 00000000000..744ed609f35 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-43mj-4x9x-534w/GHSA-43mj-4x9x-534w.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-43mj-4x9x-534w", + "modified": "2025-03-11T09:30:30Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2025-26705" + ], + "details": "Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26705" + }, + { + "type": "WEB", + "url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/577084989971263576" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T07:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-45v6-w2jm-fwmg/GHSA-45v6-w2jm-fwmg.json b/advisories/unreviewed/2025/03/GHSA-45v6-w2jm-fwmg/GHSA-45v6-w2jm-fwmg.json new file mode 100644 index 00000000000..0b23b078e71 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-45v6-w2jm-fwmg/GHSA-45v6-w2jm-fwmg.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-45v6-w2jm-fwmg", + "modified": "2025-03-11T09:30:31Z", + "published": "2025-03-11T09:30:31Z", + "aliases": [ + "CVE-2025-27893" + ], + "details": "In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such as the creation date, by intercepting and modifying a Copy request via a GenericContent/Record.aspx?id= URI. This enables unauthorized modification of system-generated metadata, compromising data integrity and potentially impacting auditing, compliance, and security controls.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27893" + }, + { + "type": "WEB", + "url": "https://archerirm.com" + }, + { + "type": "WEB", + "url": "https://github.com/NastyCrow/CVE-2025-27893" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-472" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T09:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-5478-v2w6-c6q7/GHSA-5478-v2w6-c6q7.json b/advisories/unreviewed/2025/03/GHSA-5478-v2w6-c6q7/GHSA-5478-v2w6-c6q7.json new file mode 100644 index 00000000000..89ea1b683a9 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-5478-v2w6-c6q7/GHSA-5478-v2w6-c6q7.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5478-v2w6-c6q7", + "modified": "2025-03-11T09:30:30Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2025-1550" + ], + "details": "The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1550" + }, + { + "type": "WEB", + "url": "https://github.com/keras-team/keras/pull/20751" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T09:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-62ww-4cxc-jj93/GHSA-62ww-4cxc-jj93.json b/advisories/unreviewed/2025/03/GHSA-62ww-4cxc-jj93/GHSA-62ww-4cxc-jj93.json new file mode 100644 index 00000000000..38b94b64e85 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-62ww-4cxc-jj93/GHSA-62ww-4cxc-jj93.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-62ww-4cxc-jj93", + "modified": "2025-03-11T09:30:31Z", + "published": "2025-03-11T09:30:31Z", + "aliases": [ + "CVE-2024-28607" + ], + "details": "The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via a falsy isPrivate return value.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28607" + }, + { + "type": "WEB", + "url": "https://gist.github.com/aydinnyunus/4d71e7d9a433f3afc658724b903f4d23" + }, + { + "type": "WEB", + "url": "https://github.com/librasean/IP-Utils/blob/4f88799f94f21efe6ea9135129ab2bbeb0c58edc/src/IsPrivate.ts#L4" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-180" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T09:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-7gpx-mqrw-5c9m/GHSA-7gpx-mqrw-5c9m.json b/advisories/unreviewed/2025/03/GHSA-7gpx-mqrw-5c9m/GHSA-7gpx-mqrw-5c9m.json new file mode 100644 index 00000000000..19ec5c47483 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-7gpx-mqrw-5c9m/GHSA-7gpx-mqrw-5c9m.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7gpx-mqrw-5c9m", + "modified": "2025-03-11T09:30:30Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2025-26706" + ], + "details": "Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.07.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26706" + }, + { + "type": "WEB", + "url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/6999218053484646486" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T07:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-7v7c-88p8-g95g/GHSA-7v7c-88p8-g95g.json b/advisories/unreviewed/2025/03/GHSA-7v7c-88p8-g95g/GHSA-7v7c-88p8-g95g.json new file mode 100644 index 00000000000..b82ca52aac5 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-7v7c-88p8-g95g/GHSA-7v7c-88p8-g95g.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7v7c-88p8-g95g", + "modified": "2025-03-11T09:30:31Z", + "published": "2025-03-11T09:30:31Z", + "aliases": [ + "CVE-2025-2177" + ], + "details": "A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "WEB", + "url": "https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2177" + }, + { + "type": "WEB", + "url": "https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f" + }, + { + "type": "WEB", + "url": "https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299206" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299206" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.512803" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T08:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-c5fh-wq58-2973/GHSA-c5fh-wq58-2973.json b/advisories/unreviewed/2025/03/GHSA-c5fh-wq58-2973/GHSA-c5fh-wq58-2973.json new file mode 100644 index 00000000000..06ef785f193 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-c5fh-wq58-2973/GHSA-c5fh-wq58-2973.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c5fh-wq58-2973", + "modified": "2025-03-11T09:30:31Z", + "published": "2025-03-11T09:30:31Z", + "aliases": [ + "CVE-2025-2175" + ], + "details": "A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "WEB", + "url": "https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2175" + }, + { + "type": "WEB", + "url": "https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299204" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299204" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.512801" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T07:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-jrh9-c6rr-4f9f/GHSA-jrh9-c6rr-4f9f.json b/advisories/unreviewed/2025/03/GHSA-jrh9-c6rr-4f9f/GHSA-jrh9-c6rr-4f9f.json new file mode 100644 index 00000000000..0d229a7513f --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-jrh9-c6rr-4f9f/GHSA-jrh9-c6rr-4f9f.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jrh9-c6rr-4f9f", + "modified": "2025-03-11T09:30:30Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2025-26703" + ], + "details": "Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26703" + }, + { + "type": "WEB", + "url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/5666152569221570627" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T07:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-m8hc-hmrj-mf93/GHSA-m8hc-hmrj-mf93.json b/advisories/unreviewed/2025/03/GHSA-m8hc-hmrj-mf93/GHSA-m8hc-hmrj-mf93.json new file mode 100644 index 00000000000..a1eaca16a85 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-m8hc-hmrj-mf93/GHSA-m8hc-hmrj-mf93.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m8hc-hmrj-mf93", + "modified": "2025-03-11T09:30:30Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2024-13228" + ], + "details": "The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the 'qubely_get_content'. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, password-protected, draft, and trashed post data.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13228" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/qubely/trunk/core/QUBELY.php#L1172" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3253223" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72c66e71-dddb-4142-ae13-da3caffd8714?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-359" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T07:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-mg5m-vc6f-4mvq/GHSA-mg5m-vc6f-4mvq.json b/advisories/unreviewed/2025/03/GHSA-mg5m-vc6f-4mvq/GHSA-mg5m-vc6f-4mvq.json new file mode 100644 index 00000000000..e9dc42ec448 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-mg5m-vc6f-4mvq/GHSA-mg5m-vc6f-4mvq.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mg5m-vc6f-4mvq", + "modified": "2025-03-11T09:30:31Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2025-2176" + ], + "details": "A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "WEB", + "url": "https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2176" + }, + { + "type": "WEB", + "url": "https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f" + }, + { + "type": "WEB", + "url": "https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299205" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299205" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.512802" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T08:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-mpcp-p2wc-692j/GHSA-mpcp-p2wc-692j.json b/advisories/unreviewed/2025/03/GHSA-mpcp-p2wc-692j/GHSA-mpcp-p2wc-692j.json new file mode 100644 index 00000000000..4ad21d190e8 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-mpcp-p2wc-692j/GHSA-mpcp-p2wc-692j.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mpcp-p2wc-692j", + "modified": "2025-03-11T09:30:30Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2025-27912" + ], + "details": "An issue was discovered in Datalust Seq before 2024.3.13545. Missing Content-Type validation can lead to CSRF when (1) Entra ID or OpenID Connect authentication is in use and a user visits a compromised/malicious site, or (2) when username/password or Active Directory authentication is in use and a user visits a compromised/malicious site under the same effective top-level domain as the Seq server. Exploitation of the vulnerability allows the attacker to conduct impersonation attacks and perform actions in Seq on behalf of the targeted user.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27912" + }, + { + "type": "WEB", + "url": "https://github.com/datalust/seq-tickets/issues/2366" + }, + { + "type": "WEB", + "url": "https://datalust.co/seq" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T08:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-p9fh-vhp3-p52h/GHSA-p9fh-vhp3-p52h.json b/advisories/unreviewed/2025/03/GHSA-p9fh-vhp3-p52h/GHSA-p9fh-vhp3-p52h.json new file mode 100644 index 00000000000..c6a52384308 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-p9fh-vhp3-p52h/GHSA-p9fh-vhp3-p52h.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p9fh-vhp3-p52h", + "modified": "2025-03-11T09:30:30Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2025-26702" + ], + "details": "Improper Input Validation vulnerability in ZTE GoldenDB allows Input Data Manipulation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26702" + }, + { + "type": "WEB", + "url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/1820079027271819342" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T07:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-q6rx-mvx9-c693/GHSA-q6rx-mvx9-c693.json b/advisories/unreviewed/2025/03/GHSA-q6rx-mvx9-c693/GHSA-q6rx-mvx9-c693.json new file mode 100644 index 00000000000..f6b2ec037ed --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-q6rx-mvx9-c693/GHSA-q6rx-mvx9-c693.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q6rx-mvx9-c693", + "modified": "2025-03-11T09:30:30Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2025-27911" + ], + "details": "An issue was discovered in Datalust Seq before 2024.3.13545. Expansion of identifiers in message templates can be used to bypass the system \"Event body limit bytes\" setting, leading to increased resource consumption. With sufficiently large events, there can be disk space exhaustion (if saved to disk) or a termination of the server process with an out-of-memory error.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27911" + }, + { + "type": "WEB", + "url": "https://github.com/datalust/seq-tickets/issues/2365" + }, + { + "type": "WEB", + "url": "https://datalust.co/seq" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T08:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-qwh4-xppm-94f5/GHSA-qwh4-xppm-94f5.json b/advisories/unreviewed/2025/03/GHSA-qwh4-xppm-94f5/GHSA-qwh4-xppm-94f5.json new file mode 100644 index 00000000000..cc349de21b9 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-qwh4-xppm-94f5/GHSA-qwh4-xppm-94f5.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qwh4-xppm-94f5", + "modified": "2025-03-11T09:30:30Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2025-26704" + ], + "details": "Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26704" + }, + { + "type": "WEB", + "url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/6999218053484646494" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T07:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-rcxj-mr3c-5q6h/GHSA-rcxj-mr3c-5q6h.json b/advisories/unreviewed/2025/03/GHSA-rcxj-mr3c-5q6h/GHSA-rcxj-mr3c-5q6h.json new file mode 100644 index 00000000000..92390fc637a --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-rcxj-mr3c-5q6h/GHSA-rcxj-mr3c-5q6h.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rcxj-mr3c-5q6h", + "modified": "2025-03-11T09:30:30Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2025-1434" + ], + "details": "The Spreadsheet view is vulnerable to a XSS attack, where a remote unauthorised attacker can read a limited amount of values or DoS the affected spreadsheet. Disclosure of secrets or other system settings is not affected as well as other spreadsheets still work as expected.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1434" + }, + { + "type": "WEB", + "url": "https://www.areal-topkapi.com/en/topkapi/security-bulletins" + }, + { + "type": "WEB", + "url": "https://www.areal-topkapi.com/topkapi/bulletins-de-securite" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T08:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-xp2h-p87p-622p/GHSA-xp2h-p87p-622p.json b/advisories/unreviewed/2025/03/GHSA-xp2h-p87p-622p/GHSA-xp2h-p87p-622p.json new file mode 100644 index 00000000000..86bb9ad9822 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-xp2h-p87p-622p/GHSA-xp2h-p87p-622p.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xp2h-p87p-622p", + "modified": "2025-03-11T09:30:30Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2025-2190" + ], + "details": "The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2190" + }, + { + "type": "WEB", + "url": "https://security.tecno.com/SRC/blogdetail/393?lang=en_US" + }, + { + "type": "WEB", + "url": "https://security.tecno.com/SRC/securityUpdates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-300" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T07:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-xxqq-477x-j22x/GHSA-xxqq-477x-j22x.json b/advisories/unreviewed/2025/03/GHSA-xxqq-477x-j22x/GHSA-xxqq-477x-j22x.json new file mode 100644 index 00000000000..16bd2716c7e --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-xxqq-477x-j22x/GHSA-xxqq-477x-j22x.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xxqq-477x-j22x", + "modified": "2025-03-11T09:30:30Z", + "published": "2025-03-11T09:30:30Z", + "aliases": [ + "CVE-2024-58102" + ], + "details": "An issue was discovered in Datalust Seq before 2024.3.13545. An insecure default parsing depth limit allows stack consumption when parsing user-supplied queries containing deeply nested expressions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58102" + }, + { + "type": "WEB", + "url": "https://github.com/datalust/seq-tickets/issues/2086" + }, + { + "type": "WEB", + "url": "https://github.com/datalust/seq-tickets/issues/2367" + }, + { + "type": "WEB", + "url": "https://datalust.co/seq" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-674" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-11T08:15:10Z" + } +} \ No newline at end of file