From 9dbfaa092e208fb7a464e1df69c62396c4c0072b Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 27 May 2025 09:32:13 +0000
Subject: [PATCH] Publish Advisories

GHSA-fff7-753p-rxwc
GHSA-87xr-q4cp-2xqh
GHSA-cqf6-46v7-x75c
GHSA-f2g8-qcqc-2hmv
GHSA-fg78-v6qm-37gm
GHSA-hmwm-86jc-9m8g
GHSA-qq3g-q238-5q86
GHSA-vrmf-frv2-79w2
GHSA-wppq-rwh9-h7pf
GHSA-x3pm-6vfp-j66v
---
 .../GHSA-fff7-753p-rxwc.json                  | 14 ++++++-
 .../GHSA-87xr-q4cp-2xqh.json                  | 36 +++++++++++++++++
 .../GHSA-cqf6-46v7-x75c.json                  | 36 +++++++++++++++++
 .../GHSA-f2g8-qcqc-2hmv.json                  | 36 +++++++++++++++++
 .../GHSA-fg78-v6qm-37gm.json                  | 40 +++++++++++++++++++
 .../GHSA-hmwm-86jc-9m8g.json                  | 36 +++++++++++++++++
 .../GHSA-qq3g-q238-5q86.json                  | 36 +++++++++++++++++
 .../GHSA-vrmf-frv2-79w2.json                  | 40 +++++++++++++++++++
 .../GHSA-wppq-rwh9-h7pf.json                  | 36 +++++++++++++++++
 .../GHSA-x3pm-6vfp-j66v.json                  | 36 +++++++++++++++++
 10 files changed, 345 insertions(+), 1 deletion(-)
 create mode 100644 advisories/unreviewed/2025/05/GHSA-87xr-q4cp-2xqh/GHSA-87xr-q4cp-2xqh.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-cqf6-46v7-x75c/GHSA-cqf6-46v7-x75c.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-f2g8-qcqc-2hmv/GHSA-f2g8-qcqc-2hmv.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-fg78-v6qm-37gm/GHSA-fg78-v6qm-37gm.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-hmwm-86jc-9m8g/GHSA-hmwm-86jc-9m8g.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-qq3g-q238-5q86/GHSA-qq3g-q238-5q86.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-vrmf-frv2-79w2/GHSA-vrmf-frv2-79w2.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-wppq-rwh9-h7pf/GHSA-wppq-rwh9-h7pf.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-x3pm-6vfp-j66v/GHSA-x3pm-6vfp-j66v.json

diff --git a/advisories/unreviewed/2023/09/GHSA-fff7-753p-rxwc/GHSA-fff7-753p-rxwc.json b/advisories/unreviewed/2023/09/GHSA-fff7-753p-rxwc/GHSA-fff7-753p-rxwc.json
index 902307d0841..b2c82df9c4e 100644
--- a/advisories/unreviewed/2023/09/GHSA-fff7-753p-rxwc/GHSA-fff7-753p-rxwc.json
+++ b/advisories/unreviewed/2023/09/GHSA-fff7-753p-rxwc/GHSA-fff7-753p-rxwc.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fff7-753p-rxwc",
-  "modified": "2023-09-01T21:30:59Z",
+  "modified": "2025-05-27T09:30:32Z",
   "published": "2023-09-01T21:30:59Z",
   "aliases": [
     "CVE-2023-4709"
@@ -11,6 +11,10 @@
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
     }
   ],
   "affected": [],
@@ -19,6 +23,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4709"
     },
+    {
+      "type": "WEB",
+      "url": "https://tdn.totvs.com/pages/releaseview.action?pageId=284462425#COMOAUMENTARASEGURAN%C3%87ADESUAAPLICA%C3%87%C3%83O-Reduziron%C3%ADveldedetalhamentodemensagensexibidasparaousu%C3%A1rio"
+    },
     {
       "type": "WEB",
       "url": "https://vuldb.com/?ctiid.238572"
@@ -26,6 +34,10 @@
     {
       "type": "WEB",
       "url": "https://vuldb.com/?id.238572"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.196885"
     }
   ],
   "database_specific": {
diff --git a/advisories/unreviewed/2025/05/GHSA-87xr-q4cp-2xqh/GHSA-87xr-q4cp-2xqh.json b/advisories/unreviewed/2025/05/GHSA-87xr-q4cp-2xqh/GHSA-87xr-q4cp-2xqh.json
new file mode 100644
index 00000000000..cdcf5818b5f
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-87xr-q4cp-2xqh/GHSA-87xr-q4cp-2xqh.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-87xr-q4cp-2xqh",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-41653"
+  ],
+  "details": "An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a specially crafted HTTP request with a malicious header, potentially causing the server to crash or become unresponsive.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41653"
+    },
+    {
+      "type": "WEB",
+      "url": "https://certvde.com/en/advisories/VDE-2025-044"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-410"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T09:15:21Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-cqf6-46v7-x75c/GHSA-cqf6-46v7-x75c.json b/advisories/unreviewed/2025/05/GHSA-cqf6-46v7-x75c/GHSA-cqf6-46v7-x75c.json
new file mode 100644
index 00000000000..07b39dff509
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-cqf6-46v7-x75c/GHSA-cqf6-46v7-x75c.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cqf6-46v7-x75c",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-41649"
+  ],
+  "details": "An unauthenticated remote attacker can exploit insufficient input validation to write data beyond the bounds of a buffer, potentially leading to a denial-of-service condition for the devices.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41649"
+    },
+    {
+      "type": "WEB",
+      "url": "https://certvde.com/en/advisories/VDE-2025-044"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-787"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T09:15:21Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-f2g8-qcqc-2hmv/GHSA-f2g8-qcqc-2hmv.json b/advisories/unreviewed/2025/05/GHSA-f2g8-qcqc-2hmv/GHSA-f2g8-qcqc-2hmv.json
new file mode 100644
index 00000000000..9e84515220f
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-f2g8-qcqc-2hmv/GHSA-f2g8-qcqc-2hmv.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f2g8-qcqc-2hmv",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-41650"
+  ],
+  "details": "An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially cause a denial-of-service.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41650"
+    },
+    {
+      "type": "WEB",
+      "url": "https://certvde.com/en/advisories/VDE-2025-044"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1287"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T09:15:21Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-fg78-v6qm-37gm/GHSA-fg78-v6qm-37gm.json b/advisories/unreviewed/2025/05/GHSA-fg78-v6qm-37gm/GHSA-fg78-v6qm-37gm.json
new file mode 100644
index 00000000000..428e298237d
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-fg78-v6qm-37gm/GHSA-fg78-v6qm-37gm.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fg78-v6qm-37gm",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-23393"
+  ],
+  "details": "A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in  spacewalk-java allows execution of arbitrary Javascript code on users machines.This issue affects Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; SUSE Manager Server Module 4.3: from ? before 4.3.85-150400.3.105.3.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23393"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23393"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-80"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T08:15:19Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-hmwm-86jc-9m8g/GHSA-hmwm-86jc-9m8g.json b/advisories/unreviewed/2025/05/GHSA-hmwm-86jc-9m8g/GHSA-hmwm-86jc-9m8g.json
new file mode 100644
index 00000000000..4b74e89ecc9
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-hmwm-86jc-9m8g/GHSA-hmwm-86jc-9m8g.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hmwm-86jc-9m8g",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-41652"
+  ],
+  "details": "The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could exploit this weakness by performing brute-force attacks to guess valid credentials or by using MD5 collision techniques to forge authentication hashes, potentially compromising the device.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41652"
+    },
+    {
+      "type": "WEB",
+      "url": "https://certvde.com/en/advisories/VDE-2025-044"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-656"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T09:15:21Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-qq3g-q238-5q86/GHSA-qq3g-q238-5q86.json b/advisories/unreviewed/2025/05/GHSA-qq3g-q238-5q86/GHSA-qq3g-q238-5q86.json
new file mode 100644
index 00000000000..4cc8cf79647
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-qq3g-q238-5q86/GHSA-qq3g-q238-5q86.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qq3g-q238-5q86",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-2407"
+  ],
+  "details": "Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability is fixed in Version 1.5.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2407"
+    },
+    {
+      "type": "WEB",
+      "url": "https://mobatimemtsl.github.io/Vulnerability-References"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-306"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T08:15:19Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-vrmf-frv2-79w2/GHSA-vrmf-frv2-79w2.json b/advisories/unreviewed/2025/05/GHSA-vrmf-frv2-79w2/GHSA-vrmf-frv2-79w2.json
new file mode 100644
index 00000000000..78d42aadcb4
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-vrmf-frv2-79w2/GHSA-vrmf-frv2-79w2.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vrmf-frv2-79w2",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2024-38866"
+  ],
+  "details": "Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38866"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/NagVis/nagvis/pull/398/commits/8d5d07e22dfca78df7420ac81cffff6f45ca9694"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.nagvis.org/downloads/changelog/1.9.47"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-140"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T07:15:34Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-wppq-rwh9-h7pf/GHSA-wppq-rwh9-h7pf.json b/advisories/unreviewed/2025/05/GHSA-wppq-rwh9-h7pf/GHSA-wppq-rwh9-h7pf.json
new file mode 100644
index 00000000000..f0fc8ac7733
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-wppq-rwh9-h7pf/GHSA-wppq-rwh9-h7pf.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wppq-rwh9-h7pf",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2025-41651"
+  ],
+  "details": "Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41651"
+    },
+    {
+      "type": "WEB",
+      "url": "https://certvde.com/en/advisories/VDE-2025-044"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-306"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T09:15:21Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-x3pm-6vfp-j66v/GHSA-x3pm-6vfp-j66v.json b/advisories/unreviewed/2025/05/GHSA-x3pm-6vfp-j66v/GHSA-x3pm-6vfp-j66v.json
new file mode 100644
index 00000000000..5fcf8c37661
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-x3pm-6vfp-j66v/GHSA-x3pm-6vfp-j66v.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x3pm-6vfp-j66v",
+  "modified": "2025-05-27T09:30:32Z",
+  "published": "2025-05-27T09:30:32Z",
+  "aliases": [
+    "CVE-2024-47090"
+  ],
+  "details": "Improper neutralization of input in Nagvis before version 1.9.47 which can lead to XSS",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47090"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.nagvis.org/downloads/changelog/1.9.47"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T07:15:35Z"
+  }
+}
\ No newline at end of file