Publish Advisories

GHSA-fff7-753p-rxwc GHSA-87xr-q4cp-2xqh GHSA-cqf6-46v7-x75c GHSA-f2g8-qcqc-2hmv GHSA-fg78-v6qm-37gm GHSA-hmwm-86jc-9m8g GHSA-qq3g-q238-5q86 GHSA-vrmf-frv2-79w2 GHSA-wppq-rwh9-h7pf GHSA-x3pm-6vfp-j66v
2026-05-22 18:04:22 -07:00 · 2025-05-27 09:32:13 +00:00
parent f02cb13728
commit 9dbfaa092e
10 changed files with 345 additions and 1 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fff7-753p-rxwc",
-  "modified": "2023-09-01T21:30:59Z",
+  "modified": "2025-05-27T09:30:32Z",
  "published": "2023-09-01T21:30:59Z",
  "aliases": [
    "CVE-2023-4709"
@@ -11,6 +11,10 @@
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  ],
  "affected": [],
@@ -19,6 +23,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4709"
    },
+    {
+      "type": "WEB",
+      "url": "https://tdn.totvs.com/pages/releaseview.action?pageId=284462425#COMOAUMENTARASEGURAN%C3%87ADESUAAPLICA%C3%87%C3%83O-Reduziron%C3%ADveldedetalhamentodemensagensexibidasparaousu%C3%A1rio"
+    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.238572"
@@ -26,6 +34,10 @@
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.238572"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.196885"
    }
  ],
  "database_specific": {
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-87xr-q4cp-2xqh",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-41653"
+  ],
+  "details": "An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a specially crafted HTTP request with a malicious header, potentially causing the server to crash or become unresponsive.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41653"
+    },
+    {
+      "type": "WEB",
+      "url": "https://certvde.com/en/advisories/VDE-2025-044"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-410"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T09:15:21Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cqf6-46v7-x75c",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-41649"
+  ],
+  "details": "An unauthenticated remote attacker can exploit insufficient input validation to write data beyond the bounds of a buffer, potentially leading to a denial-of-service condition for the devices.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41649"
+    },
+    {
+      "type": "WEB",
+      "url": "https://certvde.com/en/advisories/VDE-2025-044"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-787"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T09:15:21Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f2g8-qcqc-2hmv",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-41650"
+  ],
+  "details": "An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially cause a denial-of-service.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41650"
+    },
+    {
+      "type": "WEB",
+      "url": "https://certvde.com/en/advisories/VDE-2025-044"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1287"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T09:15:21Z"
+  }
+}
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fg78-v6qm-37gm",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-23393"
+  ],
+  "details": "A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in  spacewalk-java allows execution of arbitrary Javascript code on users machines.This issue affects Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23393"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23393"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-80"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T08:15:19Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hmwm-86jc-9m8g",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-41652"
+  ],
+  "details": "The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could exploit this weakness by performing brute-force attacks to guess valid credentials or by using MD5 collision techniques to forge authentication hashes, potentially compromising the device.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41652"
+    },
+    {
+      "type": "WEB",
+      "url": "https://certvde.com/en/advisories/VDE-2025-044"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-656"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T09:15:21Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qq3g-q238-5q86",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-2407"
+  ],
+  "details": "Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability is fixed in Version 1.5.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2407"
+    },
+    {
+      "type": "WEB",
+      "url": "https://mobatimemtsl.github.io/Vulnerability-References"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-306"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T08:15:19Z"
+  }
+}
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vrmf-frv2-79w2",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2024-38866"
+  ],
+  "details": "Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38866"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/NagVis/nagvis/pull/398/commits/8d5d07e22dfca78df7420ac81cffff6f45ca9694"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.nagvis.org/downloads/changelog/1.9.47"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-140"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T07:15:34Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wppq-rwh9-h7pf",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-41651"
+  ],
+  "details": "Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41651"
+    },
+    {
+      "type": "WEB",
+      "url": "https://certvde.com/en/advisories/VDE-2025-044"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-306"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T09:15:21Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x3pm-6vfp-j66v",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2024-47090"
+  ],
+  "details": "Improper neutralization of input in Nagvis before version 1.9.47 which can lead to XSS",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47090"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.nagvis.org/downloads/changelog/1.9.47"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T07:15:35Z"
+  }
+}