diff --git a/advisories/unreviewed/2024/02/GHSA-6hcj-xq8v-5j7j/GHSA-6hcj-xq8v-5j7j.json b/advisories/unreviewed/2024/02/GHSA-6hcj-xq8v-5j7j/GHSA-6hcj-xq8v-5j7j.json index 16f7a72501e..40d24880690 100644 --- a/advisories/unreviewed/2024/02/GHSA-6hcj-xq8v-5j7j/GHSA-6hcj-xq8v-5j7j.json +++ b/advisories/unreviewed/2024/02/GHSA-6hcj-xq8v-5j7j/GHSA-6hcj-xq8v-5j7j.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-6hcj-xq8v-5j7j", - "modified": "2024-02-28T21:30:20Z", + "modified": "2025-02-14T15:31:01Z", "published": "2024-02-28T21:30:20Z", "aliases": [ "CVE-2024-25435" ], "details": "A cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Msg parameter.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T20:15:41Z" diff --git a/advisories/unreviewed/2024/02/GHSA-c5jp-vv5q-7wc3/GHSA-c5jp-vv5q-7wc3.json b/advisories/unreviewed/2024/02/GHSA-c5jp-vv5q-7wc3/GHSA-c5jp-vv5q-7wc3.json index 02718904cd8..892244ba5a7 100644 --- a/advisories/unreviewed/2024/02/GHSA-c5jp-vv5q-7wc3/GHSA-c5jp-vv5q-7wc3.json +++ b/advisories/unreviewed/2024/02/GHSA-c5jp-vv5q-7wc3/GHSA-c5jp-vv5q-7wc3.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-c5jp-vv5q-7wc3", - "modified": "2024-02-28T21:30:20Z", + "modified": "2025-02-14T15:31:00Z", "published": "2024-02-28T21:30:20Z", "aliases": [ "CVE-2024-27948" ], - "details": "Cross-Site Request Forgery (CSRF) vulnerability in bytesforall Atahualpa.This issue affects Atahualpa: from n/a through 3.7.24.\n\n", + "details": "Cross-Site Request Forgery (CSRF) vulnerability in bytesforall Atahualpa.This issue affects Atahualpa: from n/a through 3.7.24.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/unreviewed/2024/03/GHSA-2mfm-m7q3-xch8/GHSA-2mfm-m7q3-xch8.json b/advisories/unreviewed/2024/03/GHSA-2mfm-m7q3-xch8/GHSA-2mfm-m7q3-xch8.json index f672ad01b15..854f3ea2f41 100644 --- a/advisories/unreviewed/2024/03/GHSA-2mfm-m7q3-xch8/GHSA-2mfm-m7q3-xch8.json +++ b/advisories/unreviewed/2024/03/GHSA-2mfm-m7q3-xch8/GHSA-2mfm-m7q3-xch8.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-2mfm-m7q3-xch8", - "modified": "2024-06-21T15:31:05Z", + "modified": "2025-02-14T15:31:01Z", "published": "2024-03-04T21:31:11Z", "aliases": [ "CVE-2021-47107" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix READDIR buffer overflow\n\nIf a client sends a READDIR count argument that is too small (say,\nzero), then the buffer size calculation in the new init_dirlist\nhelper functions results in an underflow, allowing the XDR stream\nfunctions to write beyond the actual buffer.\n\nThis calculation has always been suspect. NFSD has never sanity-\nchecked the READDIR count argument, but the old entry encoders\nmanaged the problem correctly.\n\nWith the commits below, entry encoding changed, exposing the\nunderflow to the pointer arithmetic in xdr_reserve_space().\n\nModern NFS clients attempt to retrieve as much data as possible\nfor each READDIR request. Also, we have no unit tests that\nexercise the behavior of READDIR at the lower bound of @count\nvalues. Thus this case was missed during testing.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -28,8 +33,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-120" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-04T19:15:18Z" diff --git a/advisories/unreviewed/2024/03/GHSA-2xp4-9hmm-63gj/GHSA-2xp4-9hmm-63gj.json b/advisories/unreviewed/2024/03/GHSA-2xp4-9hmm-63gj/GHSA-2xp4-9hmm-63gj.json index b3b1e469f1e..1baafd59ef3 100644 --- a/advisories/unreviewed/2024/03/GHSA-2xp4-9hmm-63gj/GHSA-2xp4-9hmm-63gj.json +++ b/advisories/unreviewed/2024/03/GHSA-2xp4-9hmm-63gj/GHSA-2xp4-9hmm-63gj.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-2xp4-9hmm-63gj", - "modified": "2024-03-04T18:30:38Z", + "modified": "2025-02-14T15:31:00Z", "published": "2024-03-04T18:30:38Z", "aliases": [ "CVE-2021-47090" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()\n\nHulk Robot reported a panic in put_page_testzero() when testing\nmadvise() with MADV_SOFT_OFFLINE. The BUG() is triggered when retrying\nget_any_page(). This is because we keep MF_COUNT_INCREASED flag in\nsecond try but the refcnt is not increased.\n\n page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)\n ------------[ cut here ]------------\n kernel BUG at include/linux/mm.h:737!\n invalid opcode: 0000 [#1] PREEMPT SMP\n CPU: 5 PID: 2135 Comm: sshd Tainted: G B 5.16.0-rc6-dirty #373\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n RIP: release_pages+0x53f/0x840\n Call Trace:\n free_pages_and_swap_cache+0x64/0x80\n tlb_flush_mmu+0x6f/0x220\n unmap_page_range+0xe6c/0x12c0\n unmap_single_vma+0x90/0x170\n unmap_vmas+0xc4/0x180\n exit_mmap+0xde/0x3a0\n mmput+0xa3/0x250\n do_exit+0x564/0x1470\n do_group_exit+0x3b/0x100\n __do_sys_exit_group+0x13/0x20\n __x64_sys_exit_group+0x16/0x20\n do_syscall_64+0x34/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n Modules linked in:\n ---[ end trace e99579b570fe0649 ]---\n RIP: 0010:release_pages+0x53f/0x840", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -29,7 +34,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-04T18:15:07Z" diff --git a/advisories/unreviewed/2024/03/GHSA-477j-vcp2-hh67/GHSA-477j-vcp2-hh67.json b/advisories/unreviewed/2024/03/GHSA-477j-vcp2-hh67/GHSA-477j-vcp2-hh67.json index 85dd047adff..d0748d5924e 100644 --- a/advisories/unreviewed/2024/03/GHSA-477j-vcp2-hh67/GHSA-477j-vcp2-hh67.json +++ b/advisories/unreviewed/2024/03/GHSA-477j-vcp2-hh67/GHSA-477j-vcp2-hh67.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-477j-vcp2-hh67", - "modified": "2024-03-04T21:31:11Z", + "modified": "2025-02-14T15:31:01Z", "published": "2024-03-04T21:31:11Z", "aliases": [ "CVE-2021-47105" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: xsk: return xsk buffers back to pool when cleaning the ring\n\nCurrently we only NULL the xdp_buff pointer in the internal SW ring but\nwe never give it back to the xsk buffer pool. This means that buffers\ncan be leaked out of the buff pool and never be used again.\n\nAdd missing xsk_buff_free() call to the routine that is supposed to\nclean the entries that are left in the ring so that these buffers in the\numem can be used by other sockets.\n\nAlso, only go through the space that is actually left to be cleaned\ninstead of a whole ring.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-401" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-04T19:15:18Z" diff --git a/advisories/unreviewed/2024/03/GHSA-cv83-m6f4-pc7m/GHSA-cv83-m6f4-pc7m.json b/advisories/unreviewed/2024/03/GHSA-cv83-m6f4-pc7m/GHSA-cv83-m6f4-pc7m.json index 16f03b78da5..ffad27a9759 100644 --- a/advisories/unreviewed/2024/03/GHSA-cv83-m6f4-pc7m/GHSA-cv83-m6f4-pc7m.json +++ b/advisories/unreviewed/2024/03/GHSA-cv83-m6f4-pc7m/GHSA-cv83-m6f4-pc7m.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-cv83-m6f4-pc7m", - "modified": "2024-03-04T18:30:39Z", + "modified": "2025-02-14T15:31:01Z", "published": "2024-03-04T18:30:38Z", "aliases": [ "CVE-2021-47097" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: elantech - fix stack out of bound access in elantech_change_report_id()\n\nThe array param[] in elantech_change_report_id() must be at least 3\nbytes, because elantech_read_reg_params() is calling ps2_command() with\nPSMOUSE_CMD_GETINFO, that is going to access 3 bytes from param[], but\nit's defined in the stack as an array of 2 bytes, therefore we have a\npotential stack out-of-bounds access here, also confirmed by KASAN:\n\n[ 6.512374] BUG: KASAN: stack-out-of-bounds in __ps2_command+0x372/0x7e0\n[ 6.512397] Read of size 1 at addr ffff8881024d77c2 by task kworker/2:1/118\n\n[ 6.512416] CPU: 2 PID: 118 Comm: kworker/2:1 Not tainted 5.13.0-22-generic #22+arighi20211110\n[ 6.512428] Hardware name: LENOVO 20T8000QGE/20T8000QGE, BIOS R1AET32W (1.08 ) 08/14/2020\n[ 6.512436] Workqueue: events_long serio_handle_event\n[ 6.512453] Call Trace:\n[ 6.512462] show_stack+0x52/0x58\n[ 6.512474] dump_stack+0xa1/0xd3\n[ 6.512487] print_address_description.constprop.0+0x1d/0x140\n[ 6.512502] ? __ps2_command+0x372/0x7e0\n[ 6.512516] __kasan_report.cold+0x7d/0x112\n[ 6.512527] ? _raw_write_lock_irq+0x20/0xd0\n[ 6.512539] ? __ps2_command+0x372/0x7e0\n[ 6.512552] kasan_report+0x3c/0x50\n[ 6.512564] __asan_load1+0x6a/0x70\n[ 6.512575] __ps2_command+0x372/0x7e0\n[ 6.512589] ? ps2_drain+0x240/0x240\n[ 6.512601] ? dev_printk_emit+0xa2/0xd3\n[ 6.512612] ? dev_vprintk_emit+0xc5/0xc5\n[ 6.512621] ? __kasan_check_write+0x14/0x20\n[ 6.512634] ? mutex_lock+0x8f/0xe0\n[ 6.512643] ? __mutex_lock_slowpath+0x20/0x20\n[ 6.512655] ps2_command+0x52/0x90\n[ 6.512670] elantech_ps2_command+0x4f/0xc0 [psmouse]\n[ 6.512734] elantech_change_report_id+0x1e6/0x256 [psmouse]\n[ 6.512799] ? elantech_report_trackpoint.constprop.0.cold+0xd/0xd [psmouse]\n[ 6.512863] ? ps2_command+0x7f/0x90\n[ 6.512877] elantech_query_info.cold+0x6bd/0x9ed [psmouse]\n[ 6.512943] ? elantech_setup_ps2+0x460/0x460 [psmouse]\n[ 6.513005] ? psmouse_reset+0x69/0xb0 [psmouse]\n[ 6.513064] ? psmouse_attr_set_helper+0x2a0/0x2a0 [psmouse]\n[ 6.513122] ? phys_pmd_init+0x30e/0x521\n[ 6.513137] elantech_init+0x8a/0x200 [psmouse]\n[ 6.513200] ? elantech_init_ps2+0xf0/0xf0 [psmouse]\n[ 6.513249] ? elantech_query_info+0x440/0x440 [psmouse]\n[ 6.513296] ? synaptics_send_cmd+0x60/0x60 [psmouse]\n[ 6.513342] ? elantech_query_info+0x440/0x440 [psmouse]\n[ 6.513388] ? psmouse_try_protocol+0x11e/0x170 [psmouse]\n[ 6.513432] psmouse_extensions+0x65d/0x6e0 [psmouse]\n[ 6.513476] ? psmouse_try_protocol+0x170/0x170 [psmouse]\n[ 6.513519] ? mutex_unlock+0x22/0x40\n[ 6.513526] ? ps2_command+0x7f/0x90\n[ 6.513536] ? psmouse_probe+0xa3/0xf0 [psmouse]\n[ 6.513580] psmouse_switch_protocol+0x27d/0x2e0 [psmouse]\n[ 6.513624] psmouse_connect+0x272/0x530 [psmouse]\n[ 6.513669] serio_driver_probe+0x55/0x70\n[ 6.513679] really_probe+0x190/0x720\n[ 6.513689] driver_probe_device+0x160/0x1f0\n[ 6.513697] device_driver_attach+0x119/0x130\n[ 6.513705] ? device_driver_attach+0x130/0x130\n[ 6.513713] __driver_attach+0xe7/0x1a0\n[ 6.513720] ? device_driver_attach+0x130/0x130\n[ 6.513728] bus_for_each_dev+0xfb/0x150\n[ 6.513738] ? subsys_dev_iter_exit+0x10/0x10\n[ 6.513748] ? _raw_write_unlock_bh+0x30/0x30\n[ 6.513757] driver_attach+0x2d/0x40\n[ 6.513764] serio_handle_event+0x199/0x3d0\n[ 6.513775] process_one_work+0x471/0x740\n[ 6.513785] worker_thread+0x2d2/0x790\n[ 6.513794] ? process_one_work+0x740/0x740\n[ 6.513802] kthread+0x1b4/0x1e0\n[ 6.513809] ? set_kthread_struct+0x80/0x80\n[ 6.513816] ret_from_fork+0x22/0x30\n\n[ 6.513832] The buggy address belongs to the page:\n[ 6.513838] page:00000000bc35e189 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1024d7\n[ 6.513847] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)\n[ 6.513860] raw: 0\n---truncated---", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -32,8 +37,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-04T18:15:08Z" diff --git a/advisories/unreviewed/2024/03/GHSA-hg5r-659j-4p32/GHSA-hg5r-659j-4p32.json b/advisories/unreviewed/2024/03/GHSA-hg5r-659j-4p32/GHSA-hg5r-659j-4p32.json index d4c3922a249..2889ba63a65 100644 --- a/advisories/unreviewed/2024/03/GHSA-hg5r-659j-4p32/GHSA-hg5r-659j-4p32.json +++ b/advisories/unreviewed/2024/03/GHSA-hg5r-659j-4p32/GHSA-hg5r-659j-4p32.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-hg5r-659j-4p32", - "modified": "2024-03-04T18:30:38Z", + "modified": "2025-02-14T15:31:01Z", "published": "2024-03-04T18:30:38Z", "aliases": [ "CVE-2021-47092" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Always clear vmx->fail on emulation_required\n\nRevert a relatively recent change that set vmx->fail if the vCPU is in L2\nand emulation_required is true, as that behavior is completely bogus.\nSetting vmx->fail and synthesizing a VM-Exit is contradictory and wrong:\n\n (a) it's impossible to have both a VM-Fail and VM-Exit\n (b) vmcs.EXIT_REASON is not modified on VM-Fail\n (c) emulation_required refers to guest state and guest state checks are\n always VM-Exits, not VM-Fails.\n\nFor KVM specifically, emulation_required is handled before nested exits\nin __vmx_handle_exit(), thus setting vmx->fail has no immediate effect,\ni.e. KVM calls into handle_invalid_guest_state() and vmx->fail is ignored.\nSetting vmx->fail can ultimately result in a WARN in nested_vmx_vmexit()\nfiring when tearing down the VM as KVM never expects vmx->fail to be set\nwhen L2 is active, KVM always reflects those errors into L1.\n\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 21158 at arch/x86/kvm/vmx/nested.c:4548\n nested_vmx_vmexit+0x16bd/0x17e0\n arch/x86/kvm/vmx/nested.c:4547\n Modules linked in:\n CPU: 0 PID: 21158 Comm: syz-executor.1 Not tainted 5.16.0-rc3-syzkaller #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n RIP: 0010:nested_vmx_vmexit+0x16bd/0x17e0 arch/x86/kvm/vmx/nested.c:4547\n Code: <0f> 0b e9 2e f8 ff ff e8 57 b3 5d 00 0f 0b e9 00 f1 ff ff 89 e9 80\n Call Trace:\n vmx_leave_nested arch/x86/kvm/vmx/nested.c:6220 [inline]\n nested_vmx_free_vcpu+0x83/0xc0 arch/x86/kvm/vmx/nested.c:330\n vmx_free_vcpu+0x11f/0x2a0 arch/x86/kvm/vmx/vmx.c:6799\n kvm_arch_vcpu_destroy+0x6b/0x240 arch/x86/kvm/x86.c:10989\n kvm_vcpu_destroy+0x29/0x90 arch/x86/kvm/../../../virt/kvm/kvm_main.c:441\n kvm_free_vcpus arch/x86/kvm/x86.c:11426 [inline]\n kvm_arch_destroy_vm+0x3ef/0x6b0 arch/x86/kvm/x86.c:11545\n kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:1189 [inline]\n kvm_put_kvm+0x751/0xe40 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1220\n kvm_vcpu_release+0x53/0x60 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3489\n __fput+0x3fc/0x870 fs/file_table.c:280\n task_work_run+0x146/0x1c0 kernel/task_work.c:164\n exit_task_work include/linux/task_work.h:32 [inline]\n do_exit+0x705/0x24f0 kernel/exit.c:832\n do_group_exit+0x168/0x2d0 kernel/exit.c:929\n get_signal+0x1740/0x2120 kernel/signal.c:2852\n arch_do_signal_or_restart+0x9c/0x730 arch/x86/kernel/signal.c:868\n handle_signal_work kernel/entry/common.c:148 [inline]\n exit_to_user_mode_loop kernel/entry/common.c:172 [inline]\n exit_to_user_mode_prepare+0x191/0x220 kernel/entry/common.c:207\n __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]\n syscall_exit_to_user_mode+0x2e/0x70 kernel/entry/common.c:300\n do_syscall_64+0x53/0xd0 arch/x86/entry/common.c:86\n entry_SYSCALL_64_after_hwframe+0x44/0xae", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -25,7 +30,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-04T18:15:07Z" diff --git a/advisories/unreviewed/2024/03/GHSA-rpv2-375w-83vr/GHSA-rpv2-375w-83vr.json b/advisories/unreviewed/2024/03/GHSA-rpv2-375w-83vr/GHSA-rpv2-375w-83vr.json index 8f5c88ce060..c72b054b1fb 100644 --- a/advisories/unreviewed/2024/03/GHSA-rpv2-375w-83vr/GHSA-rpv2-375w-83vr.json +++ b/advisories/unreviewed/2024/03/GHSA-rpv2-375w-83vr/GHSA-rpv2-375w-83vr.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-rpv2-375w-83vr", - "modified": "2024-03-04T18:30:39Z", + "modified": "2025-02-14T15:31:01Z", "published": "2024-03-04T18:30:39Z", "aliases": [ "CVE-2021-47103" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: fully convert sk->sk_rx_dst to RCU rules\n\nsyzbot reported various issues around early demux,\none being included in this changelog [1]\n\nsk->sk_rx_dst is using RCU protection without clearly\ndocumenting it.\n\nAnd following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv()\nare not following standard RCU rules.\n\n[a] dst_release(dst);\n[b] sk->sk_rx_dst = NULL;\n\nThey look wrong because a delete operation of RCU protected\npointer is supposed to clear the pointer before\nthe call_rcu()/synchronize_rcu() guarding actual memory freeing.\n\nIn some cases indeed, dst could be freed before [b] is done.\n\nWe could cheat by clearing sk_rx_dst before calling\ndst_release(), but this seems the right time to stick\nto standard RCU annotations and debugging facilities.\n\n[1]\nBUG: KASAN: use-after-free in dst_check include/net/dst.h:470 [inline]\nBUG: KASAN: use-after-free in tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792\nRead of size 2 at addr ffff88807f1cb73a by task syz-executor.5/9204\n\nCPU: 0 PID: 9204 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description.constprop.0.cold+0x8d/0x320 mm/kasan/report.c:247\n __kasan_report mm/kasan/report.c:433 [inline]\n kasan_report.cold+0x83/0xdf mm/kasan/report.c:450\n dst_check include/net/dst.h:470 [inline]\n tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792\n ip_rcv_finish_core.constprop.0+0x15de/0x1e80 net/ipv4/ip_input.c:340\n ip_list_rcv_finish.constprop.0+0x1b2/0x6e0 net/ipv4/ip_input.c:583\n ip_sublist_rcv net/ipv4/ip_input.c:609 [inline]\n ip_list_rcv+0x34e/0x490 net/ipv4/ip_input.c:644\n __netif_receive_skb_list_ptype net/core/dev.c:5508 [inline]\n __netif_receive_skb_list_core+0x549/0x8e0 net/core/dev.c:5556\n __netif_receive_skb_list net/core/dev.c:5608 [inline]\n netif_receive_skb_list_internal+0x75e/0xd80 net/core/dev.c:5699\n gro_normal_list net/core/dev.c:5853 [inline]\n gro_normal_list net/core/dev.c:5849 [inline]\n napi_complete_done+0x1f1/0x880 net/core/dev.c:6590\n virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline]\n virtnet_poll+0xca2/0x11b0 drivers/net/virtio_net.c:1557\n __napi_poll+0xaf/0x440 net/core/dev.c:7023\n napi_poll net/core/dev.c:7090 [inline]\n net_rx_action+0x801/0xb40 net/core/dev.c:7177\n __do_softirq+0x29b/0x9c2 kernel/softirq.c:558\n invoke_softirq kernel/softirq.c:432 [inline]\n __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637\n irq_exit_rcu+0x5/0x20 kernel/softirq.c:649\n common_interrupt+0x52/0xc0 arch/x86/kernel/irq.c:240\n asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:629\nRIP: 0033:0x7f5e972bfd57\nCode: 39 d1 73 14 0f 1f 80 00 00 00 00 48 8b 50 f8 48 83 e8 08 48 39 ca 77 f3 48 39 c3 73 3e 48 89 13 48 8b 50 f8 48 89 38 49 8b 0e <48> 8b 3e 48 83 c3 08 48 83 c6 08 eb bc 48 39 d1 72 9e 48 39 d0 73\nRSP: 002b:00007fff8a413210 EFLAGS: 00000283\nRAX: 00007f5e97108990 RBX: 00007f5e97108338 RCX: ffffffff81d3aa45\nRDX: ffffffff81d3aa45 RSI: 00007f5e97108340 RDI: ffffffff81d3aa45\nRBP: 00007f5e97107eb8 R08: 00007f5e97108d88 R09: 0000000093c2e8d9\nR10: 0000000000000000 R11: 0000000000000000 R12: 00007f5e97107eb0\nR13: 00007f5e97108338 R14: 00007f5e97107ea8 R15: 0000000000000019\n \n\nAllocated by task 13:\n kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38\n kasan_set_track mm/kasan/common.c:46 [inline]\n set_alloc_info mm/kasan/common.c:434 [inline]\n __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:467\n kasan_slab_alloc include/linux/kasan.h:259 [inline]\n slab_post_alloc_hook mm/slab.h:519 [inline]\n slab_alloc_node mm/slub.c:3234 [inline]\n slab_alloc mm/slub.c:3242 [inline]\n kmem_cache_alloc+0x202/0x3a0 mm/slub.c:3247\n dst_alloc+0x146/0x1f0 net/core/dst.c:92\n rt_dst_alloc+0x73/0x430 net/ipv4/route.c:1613\n ip_route_input_slow+0x1817/0x3a20 net/ipv4/route.c:234\n---truncated---", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -44,8 +49,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-04T18:15:08Z" diff --git a/advisories/unreviewed/2024/03/GHSA-vh9v-w8ph-h8v5/GHSA-vh9v-w8ph-h8v5.json b/advisories/unreviewed/2024/03/GHSA-vh9v-w8ph-h8v5/GHSA-vh9v-w8ph-h8v5.json index ba458c86ca4..24fb911c402 100644 --- a/advisories/unreviewed/2024/03/GHSA-vh9v-w8ph-h8v5/GHSA-vh9v-w8ph-h8v5.json +++ b/advisories/unreviewed/2024/03/GHSA-vh9v-w8ph-h8v5/GHSA-vh9v-w8ph-h8v5.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-vh9v-w8ph-h8v5", - "modified": "2024-03-04T18:30:39Z", + "modified": "2025-02-14T15:31:01Z", "published": "2024-03-04T18:30:39Z", "aliases": [ "CVE-2021-47102" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: marvell: prestera: fix incorrect structure access\n\nIn line:\n\tupper = info->upper_dev;\nWe access upper_dev field, which is related only for particular events\n(e.g. event == NETDEV_CHANGEUPPER). So, this line cause invalid memory\naccess for another events,\nwhen ptr is not netdev_notifier_changeupper_info.\n\nThe KASAN logs are as follows:\n\n[ 30.123165] BUG: KASAN: stack-out-of-bounds in prestera_netdev_port_event.constprop.0+0x68/0x538 [prestera]\n[ 30.133336] Read of size 8 at addr ffff80000cf772b0 by task udevd/778\n[ 30.139866]\n[ 30.141398] CPU: 0 PID: 778 Comm: udevd Not tainted 5.16.0-rc3 #6\n[ 30.147588] Hardware name: DNI AmazonGo1 A7040 board (DT)\n[ 30.153056] Call trace:\n[ 30.155547] dump_backtrace+0x0/0x2c0\n[ 30.159320] show_stack+0x18/0x30\n[ 30.162729] dump_stack_lvl+0x68/0x84\n[ 30.166491] print_address_description.constprop.0+0x74/0x2b8\n[ 30.172346] kasan_report+0x1e8/0x250\n[ 30.176102] __asan_load8+0x98/0xe0\n[ 30.179682] prestera_netdev_port_event.constprop.0+0x68/0x538 [prestera]\n[ 30.186847] prestera_netdev_event_handler+0x1b4/0x1c0 [prestera]\n[ 30.193313] raw_notifier_call_chain+0x74/0xa0\n[ 30.197860] call_netdevice_notifiers_info+0x68/0xc0\n[ 30.202924] register_netdevice+0x3cc/0x760\n[ 30.207190] register_netdev+0x24/0x50\n[ 30.211015] prestera_device_register+0x8a0/0xba0 [prestera]", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-04T18:15:08Z" diff --git a/advisories/unreviewed/2025/01/GHSA-v9p4-62pm-466x/GHSA-v9p4-62pm-466x.json b/advisories/unreviewed/2025/01/GHSA-v9p4-62pm-466x/GHSA-v9p4-62pm-466x.json index 1c90f3965c1..690480d3706 100644 --- a/advisories/unreviewed/2025/01/GHSA-v9p4-62pm-466x/GHSA-v9p4-62pm-466x.json +++ b/advisories/unreviewed/2025/01/GHSA-v9p4-62pm-466x/GHSA-v9p4-62pm-466x.json @@ -30,6 +30,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-77", "CWE-98" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2025/02/GHSA-24cm-983f-gmgx/GHSA-24cm-983f-gmgx.json b/advisories/unreviewed/2025/02/GHSA-24cm-983f-gmgx/GHSA-24cm-983f-gmgx.json new file mode 100644 index 00000000000..544d5762202 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-24cm-983f-gmgx/GHSA-24cm-983f-gmgx.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-24cm-983f-gmgx", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23492" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CantonBolo WordPress 淘宝客插件 allows Reflected XSS. This issue affects WordPress 淘宝客插件: from n/a through 1.1.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23492" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/taobaoke/vulnerability/wordpress-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-2c45-r34f-w6v8/GHSA-2c45-r34f-w6v8.json b/advisories/unreviewed/2025/02/GHSA-2c45-r34f-w6v8/GHSA-2c45-r34f-w6v8.json new file mode 100644 index 00000000000..d1979ad4196 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-2c45-r34f-w6v8/GHSA-2c45-r34f-w6v8.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2c45-r34f-w6v8", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-23851" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Coronavirus (COVID-19) Outbreak Data Widgets allows Reflected XSS. This issue affects Coronavirus (COVID-19) Outbreak Data Widgets: from n/a through 1.1.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23851" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/coronavirus-data-widgets/vulnerability/wordpress-coronavirus-covid-19-outbreak-data-widgets-plugin-1-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-2hmq-h49v-wqm8/GHSA-2hmq-h49v-wqm8.json b/advisories/unreviewed/2025/02/GHSA-2hmq-h49v-wqm8/GHSA-2hmq-h49v-wqm8.json new file mode 100644 index 00000000000..0033f68773e --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-2hmq-h49v-wqm8/GHSA-2hmq-h49v-wqm8.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2hmq-h49v-wqm8", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:05Z", + "aliases": [ + "CVE-2024-12651" + ], + "details": "Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables.This issue affects HGS Mobile App: before 6.5.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12651" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-25-0034" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-749" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T14:15:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-2wgp-4wpc-33f4/GHSA-2wgp-4wpc-33f4.json b/advisories/unreviewed/2025/02/GHSA-2wgp-4wpc-33f4/GHSA-2wgp-4wpc-33f4.json new file mode 100644 index 00000000000..92747c60e32 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-2wgp-4wpc-33f4/GHSA-2wgp-4wpc-33f4.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2wgp-4wpc-33f4", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-24564" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Contact Form With Shortcode allows Reflected XSS. This issue affects Contact Form With Shortcode: from n/a through 4.2.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24564" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/contact-form-with-shortcode/vulnerability/wordpress-contact-form-with-shortcode-plugin-4-2-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-3h89-7v9c-8256/GHSA-3h89-7v9c-8256.json b/advisories/unreviewed/2025/02/GHSA-3h89-7v9c-8256/GHSA-3h89-7v9c-8256.json new file mode 100644 index 00000000000..bc7c67734fb --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-3h89-7v9c-8256/GHSA-3h89-7v9c-8256.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3h89-7v9c-8256", + "modified": "2025-02-14T15:31:02Z", + "published": "2025-02-14T15:31:02Z", + "aliases": [ + "CVE-2025-22702" + ], + "details": "Missing Authorization vulnerability in EPC Photography. This issue affects Photography: from n/a through 7.5.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22702" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/theme/photography/vulnerability/wordpress-photography-theme-7-5-2-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-3j83-gx9f-463x/GHSA-3j83-gx9f-463x.json b/advisories/unreviewed/2025/02/GHSA-3j83-gx9f-463x/GHSA-3j83-gx9f-463x.json new file mode 100644 index 00000000000..9c57352db5f --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-3j83-gx9f-463x/GHSA-3j83-gx9f-463x.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3j83-gx9f-463x", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-24615" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Analytics Cat allows Reflected XSS. This issue affects Analytics Cat: from n/a through 1.1.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24615" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/analytics-cat/vulnerability/wordpress-analytics-cat-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-3mfm-982m-7gvc/GHSA-3mfm-982m-7gvc.json b/advisories/unreviewed/2025/02/GHSA-3mfm-982m-7gvc/GHSA-3mfm-982m-7gvc.json new file mode 100644 index 00000000000..32d822d010e --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-3mfm-982m-7gvc/GHSA-3mfm-982m-7gvc.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3mfm-982m-7gvc", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-24567" + ], + "details": "Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster allows Retrieve Embedded Sensitive Data. This issue affects WP Mailster: from n/a through 1.8.16.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24567" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-mailster/vulnerability/wordpress-wp-mailster-plugin-1-8-16-0-sensitive-data-exposure-vulnerability-2?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-201" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-43h5-c8qq-fwqf/GHSA-43h5-c8qq-fwqf.json b/advisories/unreviewed/2025/02/GHSA-43h5-c8qq-fwqf/GHSA-43h5-c8qq-fwqf.json new file mode 100644 index 00000000000..89d99817a4f --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-43h5-c8qq-fwqf/GHSA-43h5-c8qq-fwqf.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-43h5-c8qq-fwqf", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23652" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Add custom content after post allows Reflected XSS. This issue affects Add custom content after post: from n/a through 1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23652" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/add-custom-content-after-post/vulnerability/wordpress-add-custom-content-after-post-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-477g-6cm9-pqpw/GHSA-477g-6cm9-pqpw.json b/advisories/unreviewed/2025/02/GHSA-477g-6cm9-pqpw/GHSA-477g-6cm9-pqpw.json new file mode 100644 index 00000000000..49d7b2295a0 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-477g-6cm9-pqpw/GHSA-477g-6cm9-pqpw.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-477g-6cm9-pqpw", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23598" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in craig.edmunds@gmail.com Recip.ly allows Reflected XSS. This issue affects Recip.ly: from n/a through 1.1.8.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23598" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/reciply/vulnerability/wordpress-recip-ly-plugin-1-1-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-4g76-3h7v-gvxm/GHSA-4g76-3h7v-gvxm.json b/advisories/unreviewed/2025/02/GHSA-4g76-3h7v-gvxm/GHSA-4g76-3h7v-gvxm.json new file mode 100644 index 00000000000..c775ffdce3a --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-4g76-3h7v-gvxm/GHSA-4g76-3h7v-gvxm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4g76-3h7v-gvxm", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:05Z", + "aliases": [ + "CVE-2024-52895" + ], + "details": "IBM i 7.4 and 7.5 is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check. A privileged bad actor can remove or otherwise impact database infrastructure files resulting in incorrect behavior of software products that rely upon the database.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52895" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7183052" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-754" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T15:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-4h8g-6mc6-vxxj/GHSA-4h8g-6mc6-vxxj.json b/advisories/unreviewed/2025/02/GHSA-4h8g-6mc6-vxxj/GHSA-4h8g-6mc6-vxxj.json new file mode 100644 index 00000000000..b479a1d0b70 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-4h8g-6mc6-vxxj/GHSA-4h8g-6mc6-vxxj.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4h8g-6mc6-vxxj", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:05Z", + "aliases": [ + "CVE-2025-0178" + ], + "details": "Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the Web UI.\nThis issue affects Fireware OS: from 12.0 up to and including 12.11.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0178" + }, + { + "type": "WEB", + "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00003" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T14:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-4jf5-rp58-78fp/GHSA-4jf5-rp58-78fp.json b/advisories/unreviewed/2025/02/GHSA-4jf5-rp58-78fp/GHSA-4jf5-rp58-78fp.json new file mode 100644 index 00000000000..f5ead5e5153 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-4jf5-rp58-78fp/GHSA-4jf5-rp58-78fp.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4jf5-rp58-78fp", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-23905" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johannes van Poelgeest Admin Options Pages allows Reflected XSS. This issue affects Admin Options Pages: from n/a through 0.9.7.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23905" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/admin-options-pages/vulnerability/wordpress-admin-options-pages-plugin-0-9-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-4mjh-9fxc-hm78/GHSA-4mjh-9fxc-hm78.json b/advisories/unreviewed/2025/02/GHSA-4mjh-9fxc-hm78/GHSA-4mjh-9fxc-hm78.json new file mode 100644 index 00000000000..326c469e783 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-4mjh-9fxc-hm78/GHSA-4mjh-9fxc-hm78.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4mjh-9fxc-hm78", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-23751" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Data Dash allows Reflected XSS. This issue affects Data Dash: from n/a through 1.2.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23751" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/data-dash/vulnerability/wordpress-data-dash-plugin-1-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-4v39-fjgh-5mwf/GHSA-4v39-fjgh-5mwf.json b/advisories/unreviewed/2025/02/GHSA-4v39-fjgh-5mwf/GHSA-4v39-fjgh-5mwf.json new file mode 100644 index 00000000000..b8235bc6205 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-4v39-fjgh-5mwf/GHSA-4v39-fjgh-5mwf.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4v39-fjgh-5mwf", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23651" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Scroll Top allows Reflected XSS. This issue affects Scroll Top: from n/a through 1.3.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23651" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/scroll-to-top-builder/vulnerability/wordpress-scroll-top-plugin-1-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-53qj-wc3v-c7xv/GHSA-53qj-wc3v-c7xv.json b/advisories/unreviewed/2025/02/GHSA-53qj-wc3v-c7xv/GHSA-53qj-wc3v-c7xv.json new file mode 100644 index 00000000000..1ce41ecd249 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-53qj-wc3v-c7xv/GHSA-53qj-wc3v-c7xv.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-53qj-wc3v-c7xv", + "modified": "2025-02-14T15:31:02Z", + "published": "2025-02-14T15:31:02Z", + "aliases": [ + "CVE-2024-52500" + ], + "details": "Missing Authorization vulnerability in monetagwp Monetag Official Plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Monetag Official Plugin: from n/a through 1.1.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52500" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/monetag-official/vulnerability/wordpress-monetag-official-plugin-plugin-1-1-3-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-5gcv-59gg-xc7c/GHSA-5gcv-59gg-xc7c.json b/advisories/unreviewed/2025/02/GHSA-5gcv-59gg-xc7c/GHSA-5gcv-59gg-xc7c.json new file mode 100644 index 00000000000..c5b0a03cef0 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-5gcv-59gg-xc7c/GHSA-5gcv-59gg-xc7c.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5gcv-59gg-xc7c", + "modified": "2025-02-14T15:31:02Z", + "published": "2025-02-14T15:31:02Z", + "aliases": [ + "CVE-2025-0867" + ], + "details": "The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the credentials of the administrator were stored. Consequently, the EPC2 user can execute any command with administrative privileges. This allows a privilege escalation to the administrative level.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0867" + }, + { + "type": "WEB", + "url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF" + }, + { + "type": "WEB", + "url": "https://sick.com/psirt" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" + }, + { + "type": "WEB", + "url": "https://www.first.org/cvss/calculator/3.1" + }, + { + "type": "WEB", + "url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0001.json" + }, + { + "type": "WEB", + "url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0001.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-522" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-7496-f98j-6hw7/GHSA-7496-f98j-6hw7.json b/advisories/unreviewed/2025/02/GHSA-7496-f98j-6hw7/GHSA-7496-f98j-6hw7.json new file mode 100644 index 00000000000..86aa692a7ac --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-7496-f98j-6hw7/GHSA-7496-f98j-6hw7.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7496-f98j-6hw7", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-24607" + ], + "details": "Missing Authorization vulnerability in Northern Beaches Websites IdeaPush allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects IdeaPush: from n/a through 8.71.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24607" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/ideapush/vulnerability/wordpress-ideapush-plugin-8-71-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-7989-3mf5-r97w/GHSA-7989-3mf5-r97w.json b/advisories/unreviewed/2025/02/GHSA-7989-3mf5-r97w/GHSA-7989-3mf5-r97w.json new file mode 100644 index 00000000000..4b00b63dd95 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-7989-3mf5-r97w/GHSA-7989-3mf5-r97w.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7989-3mf5-r97w", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-24614" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in agileLogix Post Timeline allows Reflected XSS. This issue affects Post Timeline: from n/a through 2.3.9.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24614" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/post-timeline/vulnerability/wordpress-post-timeline-plugin-2-3-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-7f92-pjcc-3q4m/GHSA-7f92-pjcc-3q4m.json b/advisories/unreviewed/2025/02/GHSA-7f92-pjcc-3q4m/GHSA-7f92-pjcc-3q4m.json new file mode 100644 index 00000000000..3d613188068 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-7f92-pjcc-3q4m/GHSA-7f92-pjcc-3q4m.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7f92-pjcc-3q4m", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:05Z", + "aliases": [ + "CVE-2025-1239" + ], + "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the Blocked Sites list. This vulnerability requires an authenticated administrator session to a locally managed Firebox.This issue affects Fireware OS: from 12.0 through 12.5.12+701324, from 12.6 through 12.11.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1239" + }, + { + "type": "WEB", + "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00002" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T14:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-7q6f-j525-m8rr/GHSA-7q6f-j525-m8rr.json b/advisories/unreviewed/2025/02/GHSA-7q6f-j525-m8rr/GHSA-7q6f-j525-m8rr.json new file mode 100644 index 00000000000..d96ce3e3526 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-7q6f-j525-m8rr/GHSA-7q6f-j525-m8rr.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7q6f-j525-m8rr", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-23766" + ], + "details": "Missing Authorization vulnerability in ashamil OPSI Israel Domestic Shipments allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects OPSI Israel Domestic Shipments: from n/a through 2.6.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23766" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/woo-ups-pickup/vulnerability/wordpress-opsi-israel-domestic-shipments-plugin-2-6-3-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-7rx5-3mv9-446g/GHSA-7rx5-3mv9-446g.json b/advisories/unreviewed/2025/02/GHSA-7rx5-3mv9-446g/GHSA-7rx5-3mv9-446g.json new file mode 100644 index 00000000000..0462bd111e4 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-7rx5-3mv9-446g/GHSA-7rx5-3mv9-446g.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7rx5-3mv9-446g", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-24565" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team Tobias WP2LEADS allows Reflected XSS. This issue affects WP2LEADS: from n/a through 3.3.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24565" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-892g-4h6m-36mf/GHSA-892g-4h6m-36mf.json b/advisories/unreviewed/2025/02/GHSA-892g-4h6m-36mf/GHSA-892g-4h6m-36mf.json new file mode 100644 index 00000000000..3c15f0b583f --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-892g-4h6m-36mf/GHSA-892g-4h6m-36mf.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-892g-4h6m-36mf", + "modified": "2025-02-14T15:31:02Z", + "published": "2025-02-14T15:31:02Z", + "aliases": [ + "CVE-2024-13152" + ], + "details": "Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in BSS Software Mobuy Online Machinery Monitoring Panel allows SQL Injection.This issue affects Mobuy Online Machinery Monitoring Panel: before 2.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13152" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-25-0033" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-566" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-8c63-wc44-w9qp/GHSA-8c63-wc44-w9qp.json b/advisories/unreviewed/2025/02/GHSA-8c63-wc44-w9qp/GHSA-8c63-wc44-w9qp.json new file mode 100644 index 00000000000..e8d3e956899 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-8c63-wc44-w9qp/GHSA-8c63-wc44-w9qp.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8c63-wc44-w9qp", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23655" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Contact Form 7 – Paystack Add-on allows Reflected XSS. This issue affects Contact Form 7 – Paystack Add-on: from n/a through 1.2.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23655" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/cf7-paystack-add-on/vulnerability/wordpress-contact-form-7-paystack-add-on-plugin-1-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-8qrq-ggw5-w3f4/GHSA-8qrq-ggw5-w3f4.json b/advisories/unreviewed/2025/02/GHSA-8qrq-ggw5-w3f4/GHSA-8qrq-ggw5-w3f4.json new file mode 100644 index 00000000000..0b02012cc4a --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-8qrq-ggw5-w3f4/GHSA-8qrq-ggw5-w3f4.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8qrq-ggw5-w3f4", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-23857" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Essential WP Real Estate allows Reflected XSS. This issue affects Essential WP Real Estate: from n/a through 1.1.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23857" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/essential-wp-real-estate/vulnerability/wordpress-essential-wp-real-estate-plugin-1-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-93fq-fh2w-9v2v/GHSA-93fq-fh2w-9v2v.json b/advisories/unreviewed/2025/02/GHSA-93fq-fh2w-9v2v/GHSA-93fq-fh2w-9v2v.json new file mode 100644 index 00000000000..fcc304396a6 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-93fq-fh2w-9v2v/GHSA-93fq-fh2w-9v2v.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-93fq-fh2w-9v2v", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23646" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Brooks Library Instruction Recorder allows Reflected XSS. This issue affects Library Instruction Recorder: from n/a through 1.1.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23646" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/library-instruction-recorder/vulnerability/wordpress-library-instruction-recorder-plugin-1-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-9rhh-9h7r-f9gf/GHSA-9rhh-9h7r-f9gf.json b/advisories/unreviewed/2025/02/GHSA-9rhh-9h7r-f9gf/GHSA-9rhh-9h7r-f9gf.json new file mode 100644 index 00000000000..c7359f9006b --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-9rhh-9h7r-f9gf/GHSA-9rhh-9h7r-f9gf.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9rhh-9h7r-f9gf", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:05Z", + "aliases": [ + "CVE-2025-25740" + ], + "details": "D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the PSK parameter in the SetQuickVPNSettings module.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25740" + }, + { + "type": "WEB", + "url": "https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-2-1812386a66448036a1cce259beb30b04" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-c7gf-vqpv-h24v/GHSA-c7gf-vqpv-h24v.json b/advisories/unreviewed/2025/02/GHSA-c7gf-vqpv-h24v/GHSA-c7gf-vqpv-h24v.json new file mode 100644 index 00000000000..4567fb3c703 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-c7gf-vqpv-h24v/GHSA-c7gf-vqpv-h24v.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c7gf-vqpv-h24v", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23648" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wjharil AdsMiddle allows Reflected XSS. This issue affects AdsMiddle: from n/a through 1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23648" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/adsmiddle/vulnerability/wordpress-adsmiddle-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-f4g5-4hxc-84xg/GHSA-f4g5-4hxc-84xg.json b/advisories/unreviewed/2025/02/GHSA-f4g5-4hxc-84xg/GHSA-f4g5-4hxc-84xg.json new file mode 100644 index 00000000000..3314f7c8fe3 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-f4g5-4hxc-84xg/GHSA-f4g5-4hxc-84xg.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f4g5-4hxc-84xg", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:05Z", + "aliases": [ + "CVE-2025-24692" + ], + "details": "Missing Authorization vulnerability in Michael Revellin-Clerc Bulk Menu Edit allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Bulk Menu Edit: from n/a through 1.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24692" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/bulk-menu-edit/vulnerability/wordpress-bulk-menu-edit-plugin-1-3-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-ffvr-gmp3-xx43/GHSA-ffvr-gmp3-xx43.json b/advisories/unreviewed/2025/02/GHSA-ffvr-gmp3-xx43/GHSA-ffvr-gmp3-xx43.json new file mode 100644 index 00000000000..70c98440b36 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-ffvr-gmp3-xx43/GHSA-ffvr-gmp3-xx43.json @@ -0,0 +1,31 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ffvr-gmp3-xx43", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:05Z", + "aliases": [ + "CVE-2024-56180" + ], + "details": "CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\\linux\\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56180" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/k9fw0t5r7t1vbx53gs8d1r8c54rhx0wd" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T14:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-fjcf-xjg5-hcxm/GHSA-fjcf-xjg5-hcxm.json b/advisories/unreviewed/2025/02/GHSA-fjcf-xjg5-hcxm/GHSA-fjcf-xjg5-hcxm.json new file mode 100644 index 00000000000..2c41e229283 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-fjcf-xjg5-hcxm/GHSA-fjcf-xjg5-hcxm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fjcf-xjg5-hcxm", + "modified": "2025-02-14T15:31:02Z", + "published": "2025-02-14T15:31:02Z", + "aliases": [ + "CVE-2025-23428" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound QMean – WordPress Did You Mean allows Reflected XSS. This issue affects QMean – WordPress Did You Mean: from n/a through 2.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23428" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/qmean/vulnerability/wordpress-qmean-plugin-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-fwhv-hxhj-q3qm/GHSA-fwhv-hxhj-q3qm.json b/advisories/unreviewed/2025/02/GHSA-fwhv-hxhj-q3qm/GHSA-fwhv-hxhj-q3qm.json new file mode 100644 index 00000000000..d2fb37a852e --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-fwhv-hxhj-q3qm/GHSA-fwhv-hxhj-q3qm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fwhv-hxhj-q3qm", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23571" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Internal Links Generator allows Reflected XSS. This issue affects Internal Links Generator: from n/a through 3.51.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23571" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/internal-links-generator/vulnerability/wordpress-internal-links-generator-plugin-3-51-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-g36v-29xv-8g4q/GHSA-g36v-29xv-8g4q.json b/advisories/unreviewed/2025/02/GHSA-g36v-29xv-8g4q/GHSA-g36v-29xv-8g4q.json new file mode 100644 index 00000000000..79ea9cd971c --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-g36v-29xv-8g4q/GHSA-g36v-29xv-8g4q.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g36v-29xv-8g4q", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23653" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Form To Online Booking allows Reflected XSS. This issue affects Form To Online Booking: from n/a through 1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23653" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/cf7-calendly-integration/vulnerability/wordpress-form-to-online-booking-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-gj3f-x32q-h952/GHSA-gj3f-x32q-h952.json b/advisories/unreviewed/2025/02/GHSA-gj3f-x32q-h952/GHSA-gj3f-x32q-h952.json new file mode 100644 index 00000000000..0a3ae4a812c --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-gj3f-x32q-h952/GHSA-gj3f-x32q-h952.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gj3f-x32q-h952", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-24554" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awcode AWcode Toolkit allows Reflected XSS. This issue affects AWcode Toolkit: from n/a through 1.0.14.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24554" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/awcode-toolkit/vulnerability/wordpress-awcode-toolkit-plugin-1-0-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-gmm2-fvj3-r88v/GHSA-gmm2-fvj3-r88v.json b/advisories/unreviewed/2025/02/GHSA-gmm2-fvj3-r88v/GHSA-gmm2-fvj3-r88v.json new file mode 100644 index 00000000000..965a5520d8f --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-gmm2-fvj3-r88v/GHSA-gmm2-fvj3-r88v.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gmm2-fvj3-r88v", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23657" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WordPress-to-candidate for Salesforce CRM allows Reflected XSS. This issue affects WordPress-to-candidate for Salesforce CRM: from n/a through 1.0.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23657" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/salesforce-wordpress-to-candidate/vulnerability/wordpress-wordpress-to-candidate-for-salesforce-crm-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-gmr8-4xqw-xcqv/GHSA-gmr8-4xqw-xcqv.json b/advisories/unreviewed/2025/02/GHSA-gmr8-4xqw-xcqv/GHSA-gmr8-4xqw-xcqv.json new file mode 100644 index 00000000000..0288c6da254 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-gmr8-4xqw-xcqv/GHSA-gmr8-4xqw-xcqv.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gmr8-4xqw-xcqv", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23658" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tauhidul Alam Advanced Angular Contact Form allows Reflected XSS. This issue affects Advanced Angular Contact Form: from n/a through 1.1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23658" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/advanced-angular-contact-form/vulnerability/wordpress-advanced-angular-contact-form-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-h363-hgm3-pxr6/GHSA-h363-hgm3-pxr6.json b/advisories/unreviewed/2025/02/GHSA-h363-hgm3-pxr6/GHSA-h363-hgm3-pxr6.json new file mode 100644 index 00000000000..537cacef713 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-h363-hgm3-pxr6/GHSA-h363-hgm3-pxr6.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h363-hgm3-pxr6", + "modified": "2025-02-14T15:31:02Z", + "published": "2025-02-14T15:31:02Z", + "aliases": [ + "CVE-2025-22698" + ], + "details": "Missing Authorization vulnerability in Ability, Inc Accessibility Suite by Online ADA allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Accessibility Suite by Online ADA: from n/a through 4.16.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22698" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/online-accessibility/vulnerability/wordpress-accessibility-suite-by-ability-inc-plugin-4-16-multiple-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-h4rh-qr87-h68r/GHSA-h4rh-qr87-h68r.json b/advisories/unreviewed/2025/02/GHSA-h4rh-qr87-h68r/GHSA-h4rh-qr87-h68r.json new file mode 100644 index 00000000000..a823d473a72 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-h4rh-qr87-h68r/GHSA-h4rh-qr87-h68r.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h4rh-qr87-h68r", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23748" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Singsys -Awesome Gallery allows Reflected XSS. This issue affects Singsys -Awesome Gallery: from n/a through 1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23748" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/awesome-gallery-singsys/vulnerability/wordpress-singsys-awesome-gallery-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-hg7w-q48h-fqfx/GHSA-hg7w-q48h-fqfx.json b/advisories/unreviewed/2025/02/GHSA-hg7w-q48h-fqfx/GHSA-hg7w-q48h-fqfx.json new file mode 100644 index 00000000000..3a37e5082b8 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-hg7w-q48h-fqfx/GHSA-hg7w-q48h-fqfx.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hg7w-q48h-fqfx", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-24592" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SysBasics Customize My Account for WooCommerce allows Reflected XSS. This issue affects Customize My Account for WooCommerce: from n/a through 2.8.22.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24592" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/customize-my-account-for-woocommerce/vulnerability/wordpress-sysbasics-customize-my-account-for-woocommerce-plugin-2-8-22-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-hggp-5m37-vq2v/GHSA-hggp-5m37-vq2v.json b/advisories/unreviewed/2025/02/GHSA-hggp-5m37-vq2v/GHSA-hggp-5m37-vq2v.json new file mode 100644 index 00000000000..8a81abca02c --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-hggp-5m37-vq2v/GHSA-hggp-5m37-vq2v.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hggp-5m37-vq2v", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23523" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoststreamsell HSS Embed Streaming Video allows Reflected XSS. This issue affects HSS Embed Streaming Video: from n/a through 3.23.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23523" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/hss-embed-streaming-video/vulnerability/wordpress-hss-embed-streaming-video-plugin-3-23-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-hpvj-f36g-73fr/GHSA-hpvj-f36g-73fr.json b/advisories/unreviewed/2025/02/GHSA-hpvj-f36g-73fr/GHSA-hpvj-f36g-73fr.json new file mode 100644 index 00000000000..860656e0052 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-hpvj-f36g-73fr/GHSA-hpvj-f36g-73fr.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hpvj-f36g-73fr", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-24558" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks allows Reflected XSS. This issue affects CRM Perks: from n/a through 1.1.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24558" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/support-x/vulnerability/wordpress-crm-perks-plugin-1-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-hv64-fpvc-rw9x/GHSA-hv64-fpvc-rw9x.json b/advisories/unreviewed/2025/02/GHSA-hv64-fpvc-rw9x/GHSA-hv64-fpvc-rw9x.json index 806ccd93c21..6b0f62ac4a7 100644 --- a/advisories/unreviewed/2025/02/GHSA-hv64-fpvc-rw9x/GHSA-hv64-fpvc-rw9x.json +++ b/advisories/unreviewed/2025/02/GHSA-hv64-fpvc-rw9x/GHSA-hv64-fpvc-rw9x.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-hv64-fpvc-rw9x", - "modified": "2025-02-12T15:31:59Z", + "modified": "2025-02-14T15:31:02Z", "published": "2025-02-12T15:31:59Z", "aliases": [ "CVE-2025-21697" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Ensure job pointer is set to NULL after job completion\n\nAfter a job completes, the corresponding pointer in the device must\nbe set to NULL. Failing to do so triggers a warning when unloading\nthe driver, as it appears the job is still active. To prevent this,\nassign the job pointer to NULL after completing the job, indicating\nthe job has finished.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -45,7 +50,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-12T14:15:32Z" diff --git a/advisories/unreviewed/2025/02/GHSA-hw4w-fg64-2w9w/GHSA-hw4w-fg64-2w9w.json b/advisories/unreviewed/2025/02/GHSA-hw4w-fg64-2w9w/GHSA-hw4w-fg64-2w9w.json new file mode 100644 index 00000000000..66cc564e1b6 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-hw4w-fg64-2w9w/GHSA-hw4w-fg64-2w9w.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hw4w-fg64-2w9w", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-23788" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Easy Filter allows Reflected XSS. This issue affects Easy Filter: from n/a through 1.10.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23788" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/easy-filter/vulnerability/wordpress-easy-filter-plugin-1-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-j7gg-x8j3-qgpc/GHSA-j7gg-x8j3-qgpc.json b/advisories/unreviewed/2025/02/GHSA-j7gg-x8j3-qgpc/GHSA-j7gg-x8j3-qgpc.json new file mode 100644 index 00000000000..8830b7d3f33 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-j7gg-x8j3-qgpc/GHSA-j7gg-x8j3-qgpc.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j7gg-x8j3-qgpc", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23568" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fredsted WP Login Attempt Log allows Reflected XSS. This issue affects WP Login Attempt Log: from n/a through 1.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23568" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-login-attempt-log/vulnerability/wordpress-wp-login-attempt-log-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-j9jw-jrhw-54vc/GHSA-j9jw-jrhw-54vc.json b/advisories/unreviewed/2025/02/GHSA-j9jw-jrhw-54vc/GHSA-j9jw-jrhw-54vc.json new file mode 100644 index 00000000000..6a7d3713fa7 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-j9jw-jrhw-54vc/GHSA-j9jw-jrhw-54vc.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j9jw-jrhw-54vc", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:05Z", + "aliases": [ + "CVE-2025-1071" + ], + "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.This issue affects Fireware OS: from 12.0 through 12.5.12+701324, from 12.6 through 12.11.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1071" + }, + { + "type": "WEB", + "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00001" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T14:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-j9rq-6gxf-793x/GHSA-j9rq-6gxf-793x.json b/advisories/unreviewed/2025/02/GHSA-j9rq-6gxf-793x/GHSA-j9rq-6gxf-793x.json new file mode 100644 index 00000000000..e017d5de07d --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-j9rq-6gxf-793x/GHSA-j9rq-6gxf-793x.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j9rq-6gxf-793x", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-24641" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rickonline_nl Better WishList API allows Stored XSS. This issue affects Better WishList API: from n/a through 1.1.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24641" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/better-wlm-api/vulnerability/wordpress-better-wishlist-api-plugin-1-1-3-stored-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-jppw-h9g6-fhcg/GHSA-jppw-h9g6-fhcg.json b/advisories/unreviewed/2025/02/GHSA-jppw-h9g6-fhcg/GHSA-jppw-h9g6-fhcg.json new file mode 100644 index 00000000000..9df4482d510 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-jppw-h9g6-fhcg/GHSA-jppw-h9g6-fhcg.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jppw-h9g6-fhcg", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23647" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ariagle WP-Clap allows Reflected XSS. This issue affects WP-Clap: from n/a through 1.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23647" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-clap/vulnerability/wordpress-wp-clap-plugin-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-jw36-4vp7-rmq2/GHSA-jw36-4vp7-rmq2.json b/advisories/unreviewed/2025/02/GHSA-jw36-4vp7-rmq2/GHSA-jw36-4vp7-rmq2.json new file mode 100644 index 00000000000..e45a9d120fe --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-jw36-4vp7-rmq2/GHSA-jw36-4vp7-rmq2.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jw36-4vp7-rmq2", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-23771" + ], + "details": "Missing Authorization vulnerability in Murali Push Notification for Post and BuddyPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Push Notification for Post and BuddyPress: from n/a through 2.11.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23771" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/push-notification-for-post-and-buddypress/vulnerability/wordpress-push-notification-for-post-and-buddypress-plugin-2-10-settings-change-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-jw87-ch73-p69p/GHSA-jw87-ch73-p69p.json b/advisories/unreviewed/2025/02/GHSA-jw87-ch73-p69p/GHSA-jw87-ch73-p69p.json new file mode 100644 index 00000000000..24406e223d1 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-jw87-ch73-p69p/GHSA-jw87-ch73-p69p.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jw87-ch73-p69p", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23534" + ], + "details": "Missing Authorization vulnerability in Mark Winiarski WPLingo allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WPLingo: from n/a through 1.1.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23534" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wplingo/vulnerability/wordpress-wplingo-plugin-1-1-2-arbitrary-content-deletion-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-p3v6-vjw3-gr96/GHSA-p3v6-vjw3-gr96.json b/advisories/unreviewed/2025/02/GHSA-p3v6-vjw3-gr96/GHSA-p3v6-vjw3-gr96.json new file mode 100644 index 00000000000..92b1859ed08 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-p3v6-vjw3-gr96/GHSA-p3v6-vjw3-gr96.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p3v6-vjw3-gr96", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-23742" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podamibe Nepal Podamibe Twilio Private Call allows Reflected XSS. This issue affects Podamibe Twilio Private Call: from n/a through 1.0.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23742" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/podamibe-twilio-private-call/vulnerability/wordpress-podamibe-twilio-private-call-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-pmwx-c8h5-g4vm/GHSA-pmwx-c8h5-g4vm.json b/advisories/unreviewed/2025/02/GHSA-pmwx-c8h5-g4vm/GHSA-pmwx-c8h5-g4vm.json new file mode 100644 index 00000000000..b164fc0f4f0 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-pmwx-c8h5-g4vm/GHSA-pmwx-c8h5-g4vm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pmwx-c8h5-g4vm", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:05Z", + "aliases": [ + "CVE-2025-24688" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster allows Reflected XSS. This issue affects WP Mailster: from n/a through 1.8.20.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24688" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-mailster/vulnerability/wordpress-wp-mailster-plugin-1-8-20-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-qhqv-7h9v-g7hm/GHSA-qhqv-7h9v-g7hm.json b/advisories/unreviewed/2025/02/GHSA-qhqv-7h9v-g7hm/GHSA-qhqv-7h9v-g7hm.json new file mode 100644 index 00000000000..621298e3a80 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-qhqv-7h9v-g7hm/GHSA-qhqv-7h9v-g7hm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qhqv-7h9v-g7hm", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-23789" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tahminajannat URL Shortener | Conversion Tracking | AB Testing | WooCommerce allows Reflected XSS. This issue affects URL Shortener | Conversion Tracking | AB Testing | WooCommerce: from n/a through 9.0.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23789" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/easy-broken-link-checker/vulnerability/wordpress-url-shortener-woocommerce-plugin-9-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-qq7r-jjr4-m4cx/GHSA-qq7r-jjr4-m4cx.json b/advisories/unreviewed/2025/02/GHSA-qq7r-jjr4-m4cx/GHSA-qq7r-jjr4-m4cx.json new file mode 100644 index 00000000000..8be137c4d22 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-qq7r-jjr4-m4cx/GHSA-qq7r-jjr4-m4cx.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qq7r-jjr4-m4cx", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-23786" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DuoGeek Email to Download allows Reflected XSS. This issue affects Email to Download: from n/a through 3.1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23786" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/email-to-download/vulnerability/wordpress-email-to-download-plugin-3-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-qvh8-2fqm-584p/GHSA-qvh8-2fqm-584p.json b/advisories/unreviewed/2025/02/GHSA-qvh8-2fqm-584p/GHSA-qvh8-2fqm-584p.json index 521e70edfee..c6cc1ee637b 100644 --- a/advisories/unreviewed/2025/02/GHSA-qvh8-2fqm-584p/GHSA-qvh8-2fqm-584p.json +++ b/advisories/unreviewed/2025/02/GHSA-qvh8-2fqm-584p/GHSA-qvh8-2fqm-584p.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-qvh8-2fqm-584p", - "modified": "2025-02-12T15:31:59Z", + "modified": "2025-02-14T15:31:01Z", "published": "2025-02-12T15:31:59Z", "aliases": [ "CVE-2025-21699" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Truncate address space when flipping GFS2_DIF_JDATA flag\n\nTruncate an inode's address space when flipping the GFS2_DIF_JDATA flag:\ndepending on that flag, the pages in the address space will either use\nbuffer heads or iomap_folio_state structs, and we cannot mix the two.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -49,7 +54,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-12T14:15:33Z" diff --git a/advisories/unreviewed/2025/02/GHSA-qwwc-4vgw-qh7j/GHSA-qwwc-4vgw-qh7j.json b/advisories/unreviewed/2025/02/GHSA-qwwc-4vgw-qh7j/GHSA-qwwc-4vgw-qh7j.json new file mode 100644 index 00000000000..2701d2d7dc2 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-qwwc-4vgw-qh7j/GHSA-qwwc-4vgw-qh7j.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qwwc-4vgw-qh7j", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-23853" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in michelem NoFollow Free allows Reflected XSS. This issue affects NoFollow Free: from n/a through 1.6.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23853" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/nofollow-free/vulnerability/wordpress-nofollow-free-plugin-1-6-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-qxcr-5h9v-q8vc/GHSA-qxcr-5h9v-q8vc.json b/advisories/unreviewed/2025/02/GHSA-qxcr-5h9v-q8vc/GHSA-qxcr-5h9v-q8vc.json new file mode 100644 index 00000000000..fa6419c4226 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-qxcr-5h9v-q8vc/GHSA-qxcr-5h9v-q8vc.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qxcr-5h9v-q8vc", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:05Z", + "aliases": [ + "CVE-2024-56477" + ], + "details": "IBM Power Hardware Management Console V10.3.1050.0 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56477" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7183224" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T15:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-rj2j-8m93-h8qr/GHSA-rj2j-8m93-h8qr.json b/advisories/unreviewed/2025/02/GHSA-rj2j-8m93-h8qr/GHSA-rj2j-8m93-h8qr.json new file mode 100644 index 00000000000..65240ca4f4d --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-rj2j-8m93-h8qr/GHSA-rj2j-8m93-h8qr.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rj2j-8m93-h8qr", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:05Z", + "aliases": [ + "CVE-2025-24699" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company WP Coder allows Cross-Site Scripting (XSS). This issue affects WP Coder: from n/a through 3.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24699" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-coder/vulnerability/wordpress-wp-coder-plugin-3-6-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-rq5x-c86f-3rgm/GHSA-rq5x-c86f-3rgm.json b/advisories/unreviewed/2025/02/GHSA-rq5x-c86f-3rgm/GHSA-rq5x-c86f-3rgm.json new file mode 100644 index 00000000000..fd472bcf756 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-rq5x-c86f-3rgm/GHSA-rq5x-c86f-3rgm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rq5x-c86f-3rgm", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-24616" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UIUX Lab Uix Page Builder allows Reflected XSS. This issue affects Uix Page Builder: from n/a through 1.7.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24616" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/uix-page-builder/vulnerability/wordpress-uix-page-builder-plugin-1-7-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-rqfh-gxgg-44vm/GHSA-rqfh-gxgg-44vm.json b/advisories/unreviewed/2025/02/GHSA-rqfh-gxgg-44vm/GHSA-rqfh-gxgg-44vm.json new file mode 100644 index 00000000000..68124c51f2e --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-rqfh-gxgg-44vm/GHSA-rqfh-gxgg-44vm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rqfh-gxgg-44vm", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-23790" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wassereimer Easy Code Placement allows Reflected XSS. This issue affects Easy Code Placement: from n/a through 18.11.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23790" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/easy-code-placement/vulnerability/wordpress-easy-code-placement-plugin-18-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-rv9q-4h5w-gqfp/GHSA-rv9q-4h5w-gqfp.json b/advisories/unreviewed/2025/02/GHSA-rv9q-4h5w-gqfp/GHSA-rv9q-4h5w-gqfp.json new file mode 100644 index 00000000000..73a421e9d60 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-rv9q-4h5w-gqfp/GHSA-rv9q-4h5w-gqfp.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rv9q-4h5w-gqfp", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-24566" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomáš Groulík Intro Tour Tutorial DeepPresentation allows Reflected XSS. This issue affects Intro Tour Tutorial DeepPresentation: from n/a through 6.5.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24566" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/dp-intro-tours/vulnerability/wordpress-intro-tour-tutorial-deeppresentation-plugin-6-5-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-rx5c-wxq4-wp76/GHSA-rx5c-wxq4-wp76.json b/advisories/unreviewed/2025/02/GHSA-rx5c-wxq4-wp76/GHSA-rx5c-wxq4-wp76.json new file mode 100644 index 00000000000..4789710d32c --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-rx5c-wxq4-wp76/GHSA-rx5c-wxq4-wp76.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rx5c-wxq4-wp76", + "modified": "2025-02-14T15:31:05Z", + "published": "2025-02-14T15:31:05Z", + "aliases": [ + "CVE-2025-24700" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Reflected XSS. This issue affects WP Event Aggregator: from n/a through 1.8.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24700" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wp-event-aggregator/vulnerability/wordpress-wp-event-aggregator-plugin-1-8-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-v3vw-5ppq-6vr8/GHSA-v3vw-5ppq-6vr8.json b/advisories/unreviewed/2025/02/GHSA-v3vw-5ppq-6vr8/GHSA-v3vw-5ppq-6vr8.json new file mode 100644 index 00000000000..9a4c817d6b7 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-v3vw-5ppq-6vr8/GHSA-v3vw-5ppq-6vr8.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v3vw-5ppq-6vr8", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23650" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp Tidy.ro allows Reflected XSS. This issue affects Tidy.ro: from n/a through 1.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23650" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/tidyro/vulnerability/wordpress-tidy-ro-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-v63w-9p2g-vprx/GHSA-v63w-9p2g-vprx.json b/advisories/unreviewed/2025/02/GHSA-v63w-9p2g-vprx/GHSA-v63w-9p2g-vprx.json new file mode 100644 index 00000000000..c29246ec411 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-v63w-9p2g-vprx/GHSA-v63w-9p2g-vprx.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v63w-9p2g-vprx", + "modified": "2025-02-14T15:31:02Z", + "published": "2025-02-14T15:31:02Z", + "aliases": [ + "CVE-2025-22705" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in godthor Disqus Popular Posts allows Reflected XSS. This issue affects Disqus Popular Posts: from n/a through 2.1.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22705" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/disqus-popular-posts/vulnerability/wordpress-disqus-popular-posts-plugin-2-1-1-csrf-to-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-v7mx-c56x-8rqj/GHSA-v7mx-c56x-8rqj.json b/advisories/unreviewed/2025/02/GHSA-v7mx-c56x-8rqj/GHSA-v7mx-c56x-8rqj.json new file mode 100644 index 00000000000..860dd1cee14 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-v7mx-c56x-8rqj/GHSA-v7mx-c56x-8rqj.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v7mx-c56x-8rqj", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23525" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kvvaradha Kv Compose Email From Dashboard allows Reflected XSS. This issue affects Kv Compose Email From Dashboard: from n/a through 1.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23525" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/kv-send-email-from-admin/vulnerability/wordpress-kv-compose-email-from-dashboard-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-v9vq-v9w6-g7vv/GHSA-v9vq-v9w6-g7vv.json b/advisories/unreviewed/2025/02/GHSA-v9vq-v9w6-g7vv/GHSA-v9vq-v9w6-g7vv.json new file mode 100644 index 00000000000..39c7e168eca --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-v9vq-v9w6-g7vv/GHSA-v9vq-v9w6-g7vv.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v9vq-v9w6-g7vv", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-23787" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Easy Bet allows Reflected XSS. This issue affects Easy Bet: from n/a through 1.0.7.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23787" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/easy-bet/vulnerability/wordpress-easy-bet-plugin-1-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-vcg5-2qf3-89wc/GHSA-vcg5-2qf3-89wc.json b/advisories/unreviewed/2025/02/GHSA-vcg5-2qf3-89wc/GHSA-vcg5-2qf3-89wc.json new file mode 100644 index 00000000000..5f3e6aba778 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-vcg5-2qf3-89wc/GHSA-vcg5-2qf3-89wc.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vcg5-2qf3-89wc", + "modified": "2025-02-14T15:31:04Z", + "published": "2025-02-14T15:31:04Z", + "aliases": [ + "CVE-2025-24617" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter allows Reflected XSS. This issue affects AcyMailing SMTP Newsletter: from n/a through n/a.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24617" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/acymailing/vulnerability/wordpress-acymailing-plugin-9-11-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-vf5v-7xg7-4m2w/GHSA-vf5v-7xg7-4m2w.json b/advisories/unreviewed/2025/02/GHSA-vf5v-7xg7-4m2w/GHSA-vf5v-7xg7-4m2w.json new file mode 100644 index 00000000000..4574e25c58f --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-vf5v-7xg7-4m2w/GHSA-vf5v-7xg7-4m2w.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vf5v-7xg7-4m2w", + "modified": "2025-02-14T15:31:02Z", + "published": "2025-02-14T15:31:02Z", + "aliases": [ + "CVE-2025-23431" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Envato Affiliater allows Reflected XSS. This issue affects Envato Affiliater: from n/a through 1.2.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23431" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/envato-affiliater/vulnerability/wordpress-envato-affiliater-plugin-1-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-vmch-24rx-mg5h/GHSA-vmch-24rx-mg5h.json b/advisories/unreviewed/2025/02/GHSA-vmch-24rx-mg5h/GHSA-vmch-24rx-mg5h.json new file mode 100644 index 00000000000..19ed9a9f088 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-vmch-24rx-mg5h/GHSA-vmch-24rx-mg5h.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vmch-24rx-mg5h", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:03Z", + "aliases": [ + "CVE-2025-23750" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devbunchuk Custom Widget Creator allows Reflected XSS. This issue affects Custom Widget Creator: from n/a through 1.0.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23750" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/custom-widget-creator/vulnerability/wordpress-custom-widget-creator-plugin-1-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-xcv5-f7pg-qqvj/GHSA-xcv5-f7pg-qqvj.json b/advisories/unreviewed/2025/02/GHSA-xcv5-f7pg-qqvj/GHSA-xcv5-f7pg-qqvj.json new file mode 100644 index 00000000000..aee8443f4e9 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-xcv5-f7pg-qqvj/GHSA-xcv5-f7pg-qqvj.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xcv5-f7pg-qqvj", + "modified": "2025-02-14T15:31:03Z", + "published": "2025-02-14T15:31:02Z", + "aliases": [ + "CVE-2025-23474" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mike Martel Live Dashboard allows Reflected XSS. This issue affects Live Dashboard: from n/a through 0.3.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23474" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/live-dashboard/vulnerability/wordpress-live-dashboard-plugin-0-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-14T13:15:43Z" + } +} \ No newline at end of file