From a5b16683593488d570b5d7cd3943c8f852540dbd Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 7 Apr 2025 15:33:01 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-q4cw-h889-p6jj.json | 1 + .../GHSA-fqrj-wwq6-q94w.json | 4 +- .../GHSA-rfj8-v7wf-3hfc.json | 4 +- .../GHSA-c382-wfjm-cr9h.json | 3 +- .../GHSA-23rf-wq7x-gvq7.json | 55 +++++++++++++++++ .../GHSA-2749-6w3x-fm28.json | 36 +++++++++++ .../GHSA-2c38-3wjv-55hm.json | 56 +++++++++++++++++ .../GHSA-2cq5-j9m5-v929.json | 60 +++++++++++++++++++ .../GHSA-2f7m-9j2c-gwvw.json | 4 +- .../GHSA-2ggh-pp2g-4gr9.json | 52 ++++++++++++++++ .../GHSA-33q9-fp3q-fw2p.json | 36 +++++++++++ .../GHSA-3435-f6h9-64p7.json | 40 +++++++++++++ .../GHSA-3qpr-rxgf-wxq6.json | 36 +++++++++++ .../GHSA-4q3j-j6j7-qr2f.json | 56 +++++++++++++++++ .../GHSA-4x43-w54x-gjc8.json | 52 ++++++++++++++++ .../GHSA-527p-356f-cgq4.json | 50 ++++++++++++++++ .../GHSA-5hjr-4ff9-h4hx.json | 36 +++++++++++ .../GHSA-5px6-qr34-v59r.json | 56 +++++++++++++++++ .../GHSA-6839-6896-r9mx.json | 40 +++++++++++++ .../GHSA-69gq-2xc5-f33j.json | 40 +++++++++++++ .../GHSA-6r9p-wm3j-2fmc.json | 52 ++++++++++++++++ .../GHSA-6vqr-8xjq-ghqg.json | 11 +++- .../GHSA-779c-58c4-6v6c.json | 40 +++++++++++++ .../GHSA-77wp-9m8w-r2j3.json | 52 ++++++++++++++++ .../GHSA-7r4x-ff5h-ghvg.json | 52 ++++++++++++++++ .../GHSA-8359-6xxw-qm22.json | 11 +++- .../GHSA-88rv-3gw6-829j.json | 11 +++- .../GHSA-9867-8p52-837m.json | 52 ++++++++++++++++ .../GHSA-9j63-jqr8-fh2v.json | 40 +++++++++++++ .../GHSA-9rx6-r638-rfhr.json | 52 ++++++++++++++++ .../GHSA-9xjh-c5x2-3cqm.json | 56 +++++++++++++++++ .../GHSA-c662-cq7c-gxxm.json | 36 +++++++++++ .../GHSA-c7w9-6gg4-jgw9.json | 36 +++++++++++ .../GHSA-c995-4fw3-j39m.json | 40 +++++++++++++ .../GHSA-c9h5-c8wm-8m25.json | 36 +++++++++++ .../GHSA-ch4m-2996-7xpv.json | 43 +++++++++++++ .../GHSA-chv8-32cq-8ghq.json | 15 +++-- .../GHSA-f3r5-jm79-fwqg.json | 36 +++++++++++ .../GHSA-f5jv-rh3p-2g3q.json | 48 +++++++++++++++ .../GHSA-f8pp-r5jc-65w2.json | 36 +++++++++++ .../GHSA-f9r4-j32j-wpx3.json | 11 +++- .../GHSA-fv2f-q5hc-738w.json | 52 ++++++++++++++++ .../GHSA-gfj4-2p4p-m25j.json | 47 +++++++++++++++ .../GHSA-h335-fwrx-9fx8.json | 44 ++++++++++++++ .../GHSA-hp4v-q7qc-45wr.json | 29 +++++++++ .../GHSA-hpcf-gj4m-m22c.json | 44 ++++++++++++++ .../GHSA-hvmf-h8x8-34xp.json | 56 +++++++++++++++++ .../GHSA-hvwq-39r8-6778.json | 40 +++++++++++++ .../GHSA-hx6m-xfx3-6p5x.json | 47 +++++++++++++++ .../GHSA-j882-wwwr-7r6q.json | 36 +++++++++++ .../GHSA-jc96-wpqj-97v4.json | 52 ++++++++++++++++ .../GHSA-jv3r-2v53-4w3v.json | 52 ++++++++++++++++ .../GHSA-jx87-jq84-246c.json | 52 ++++++++++++++++ .../GHSA-jxhv-99m9-3f9j.json | 52 ++++++++++++++++ .../GHSA-m9x3-4g44-fw28.json | 11 +++- .../GHSA-mjv8-w698-v8wq.json | 11 +++- .../GHSA-p53j-gw5m-pf4h.json | 56 +++++++++++++++++ .../GHSA-ph62-3p55-vjx4.json | 56 +++++++++++++++++ .../GHSA-pw3g-hp64-xmx9.json | 3 +- .../GHSA-px97-mh8q-mm22.json | 36 +++++++++++ .../GHSA-q4cw-226g-6pc5.json | 52 ++++++++++++++++ .../GHSA-q7wx-4c6m-pm7w.json | 15 +++-- .../GHSA-qw6j-957m-52hg.json | 36 +++++++++++ .../GHSA-r2cw-qpww-vp9w.json | 52 ++++++++++++++++ .../GHSA-r4rq-7765-p57x.json | 40 +++++++++++++ .../GHSA-v3wx-2c9x-448x.json | 56 +++++++++++++++++ .../GHSA-v9gv-mwp4-wx7g.json | 36 +++++++++++ .../GHSA-vfcc-48gf-g8mq.json | 56 +++++++++++++++++ .../GHSA-w447-6x96-2x3p.json | 6 +- .../GHSA-w888-5xmr-28f6.json | 56 +++++++++++++++++ .../GHSA-wr7w-v9gf-rw8c.json | 56 +++++++++++++++++ .../GHSA-x9f6-hx4w-vq6q.json | 15 +++-- .../GHSA-xc47-677g-jg4q.json | 11 +++- .../GHSA-xc95-rpw4-jf66.json | 60 +++++++++++++++++++ .../GHSA-xp37-x766-f7v4.json | 56 +++++++++++++++++ .../GHSA-xqjh-59ww-r864.json | 52 ++++++++++++++++ .../GHSA-xrm4-vc7m-v28j.json | 56 +++++++++++++++++ .../GHSA-xrqc-54h4-vmvv.json | 11 +++- 78 files changed, 2939 insertions(+), 42 deletions(-) create mode 100644 advisories/unreviewed/2025/04/GHSA-23rf-wq7x-gvq7/GHSA-23rf-wq7x-gvq7.json create mode 100644 advisories/unreviewed/2025/04/GHSA-2749-6w3x-fm28/GHSA-2749-6w3x-fm28.json create mode 100644 advisories/unreviewed/2025/04/GHSA-2c38-3wjv-55hm/GHSA-2c38-3wjv-55hm.json create mode 100644 advisories/unreviewed/2025/04/GHSA-2cq5-j9m5-v929/GHSA-2cq5-j9m5-v929.json create mode 100644 advisories/unreviewed/2025/04/GHSA-2ggh-pp2g-4gr9/GHSA-2ggh-pp2g-4gr9.json create mode 100644 advisories/unreviewed/2025/04/GHSA-33q9-fp3q-fw2p/GHSA-33q9-fp3q-fw2p.json create mode 100644 advisories/unreviewed/2025/04/GHSA-3435-f6h9-64p7/GHSA-3435-f6h9-64p7.json create mode 100644 advisories/unreviewed/2025/04/GHSA-3qpr-rxgf-wxq6/GHSA-3qpr-rxgf-wxq6.json create mode 100644 advisories/unreviewed/2025/04/GHSA-4q3j-j6j7-qr2f/GHSA-4q3j-j6j7-qr2f.json create mode 100644 advisories/unreviewed/2025/04/GHSA-4x43-w54x-gjc8/GHSA-4x43-w54x-gjc8.json create mode 100644 advisories/unreviewed/2025/04/GHSA-527p-356f-cgq4/GHSA-527p-356f-cgq4.json create mode 100644 advisories/unreviewed/2025/04/GHSA-5hjr-4ff9-h4hx/GHSA-5hjr-4ff9-h4hx.json create mode 100644 advisories/unreviewed/2025/04/GHSA-5px6-qr34-v59r/GHSA-5px6-qr34-v59r.json create mode 100644 advisories/unreviewed/2025/04/GHSA-6839-6896-r9mx/GHSA-6839-6896-r9mx.json create mode 100644 advisories/unreviewed/2025/04/GHSA-69gq-2xc5-f33j/GHSA-69gq-2xc5-f33j.json create mode 100644 advisories/unreviewed/2025/04/GHSA-6r9p-wm3j-2fmc/GHSA-6r9p-wm3j-2fmc.json create mode 100644 advisories/unreviewed/2025/04/GHSA-779c-58c4-6v6c/GHSA-779c-58c4-6v6c.json create mode 100644 advisories/unreviewed/2025/04/GHSA-77wp-9m8w-r2j3/GHSA-77wp-9m8w-r2j3.json create mode 100644 advisories/unreviewed/2025/04/GHSA-7r4x-ff5h-ghvg/GHSA-7r4x-ff5h-ghvg.json create mode 100644 advisories/unreviewed/2025/04/GHSA-9867-8p52-837m/GHSA-9867-8p52-837m.json create mode 100644 advisories/unreviewed/2025/04/GHSA-9j63-jqr8-fh2v/GHSA-9j63-jqr8-fh2v.json create mode 100644 advisories/unreviewed/2025/04/GHSA-9rx6-r638-rfhr/GHSA-9rx6-r638-rfhr.json create mode 100644 advisories/unreviewed/2025/04/GHSA-9xjh-c5x2-3cqm/GHSA-9xjh-c5x2-3cqm.json create mode 100644 advisories/unreviewed/2025/04/GHSA-c662-cq7c-gxxm/GHSA-c662-cq7c-gxxm.json create mode 100644 advisories/unreviewed/2025/04/GHSA-c7w9-6gg4-jgw9/GHSA-c7w9-6gg4-jgw9.json create mode 100644 advisories/unreviewed/2025/04/GHSA-c995-4fw3-j39m/GHSA-c995-4fw3-j39m.json create mode 100644 advisories/unreviewed/2025/04/GHSA-c9h5-c8wm-8m25/GHSA-c9h5-c8wm-8m25.json create mode 100644 advisories/unreviewed/2025/04/GHSA-ch4m-2996-7xpv/GHSA-ch4m-2996-7xpv.json create mode 100644 advisories/unreviewed/2025/04/GHSA-f3r5-jm79-fwqg/GHSA-f3r5-jm79-fwqg.json create mode 100644 advisories/unreviewed/2025/04/GHSA-f5jv-rh3p-2g3q/GHSA-f5jv-rh3p-2g3q.json create mode 100644 advisories/unreviewed/2025/04/GHSA-f8pp-r5jc-65w2/GHSA-f8pp-r5jc-65w2.json create mode 100644 advisories/unreviewed/2025/04/GHSA-fv2f-q5hc-738w/GHSA-fv2f-q5hc-738w.json create mode 100644 advisories/unreviewed/2025/04/GHSA-gfj4-2p4p-m25j/GHSA-gfj4-2p4p-m25j.json create mode 100644 advisories/unreviewed/2025/04/GHSA-h335-fwrx-9fx8/GHSA-h335-fwrx-9fx8.json create mode 100644 advisories/unreviewed/2025/04/GHSA-hp4v-q7qc-45wr/GHSA-hp4v-q7qc-45wr.json create mode 100644 advisories/unreviewed/2025/04/GHSA-hpcf-gj4m-m22c/GHSA-hpcf-gj4m-m22c.json create mode 100644 advisories/unreviewed/2025/04/GHSA-hvmf-h8x8-34xp/GHSA-hvmf-h8x8-34xp.json create mode 100644 advisories/unreviewed/2025/04/GHSA-hvwq-39r8-6778/GHSA-hvwq-39r8-6778.json create mode 100644 advisories/unreviewed/2025/04/GHSA-hx6m-xfx3-6p5x/GHSA-hx6m-xfx3-6p5x.json create mode 100644 advisories/unreviewed/2025/04/GHSA-j882-wwwr-7r6q/GHSA-j882-wwwr-7r6q.json create mode 100644 advisories/unreviewed/2025/04/GHSA-jc96-wpqj-97v4/GHSA-jc96-wpqj-97v4.json create mode 100644 advisories/unreviewed/2025/04/GHSA-jv3r-2v53-4w3v/GHSA-jv3r-2v53-4w3v.json create mode 100644 advisories/unreviewed/2025/04/GHSA-jx87-jq84-246c/GHSA-jx87-jq84-246c.json create mode 100644 advisories/unreviewed/2025/04/GHSA-jxhv-99m9-3f9j/GHSA-jxhv-99m9-3f9j.json create mode 100644 advisories/unreviewed/2025/04/GHSA-p53j-gw5m-pf4h/GHSA-p53j-gw5m-pf4h.json create mode 100644 advisories/unreviewed/2025/04/GHSA-ph62-3p55-vjx4/GHSA-ph62-3p55-vjx4.json create mode 100644 advisories/unreviewed/2025/04/GHSA-px97-mh8q-mm22/GHSA-px97-mh8q-mm22.json create mode 100644 advisories/unreviewed/2025/04/GHSA-q4cw-226g-6pc5/GHSA-q4cw-226g-6pc5.json create mode 100644 advisories/unreviewed/2025/04/GHSA-qw6j-957m-52hg/GHSA-qw6j-957m-52hg.json create mode 100644 advisories/unreviewed/2025/04/GHSA-r2cw-qpww-vp9w/GHSA-r2cw-qpww-vp9w.json create mode 100644 advisories/unreviewed/2025/04/GHSA-r4rq-7765-p57x/GHSA-r4rq-7765-p57x.json create mode 100644 advisories/unreviewed/2025/04/GHSA-v3wx-2c9x-448x/GHSA-v3wx-2c9x-448x.json create mode 100644 advisories/unreviewed/2025/04/GHSA-v9gv-mwp4-wx7g/GHSA-v9gv-mwp4-wx7g.json create mode 100644 advisories/unreviewed/2025/04/GHSA-vfcc-48gf-g8mq/GHSA-vfcc-48gf-g8mq.json create mode 100644 advisories/unreviewed/2025/04/GHSA-w888-5xmr-28f6/GHSA-w888-5xmr-28f6.json create mode 100644 advisories/unreviewed/2025/04/GHSA-wr7w-v9gf-rw8c/GHSA-wr7w-v9gf-rw8c.json create mode 100644 advisories/unreviewed/2025/04/GHSA-xc95-rpw4-jf66/GHSA-xc95-rpw4-jf66.json create mode 100644 advisories/unreviewed/2025/04/GHSA-xp37-x766-f7v4/GHSA-xp37-x766-f7v4.json create mode 100644 advisories/unreviewed/2025/04/GHSA-xqjh-59ww-r864/GHSA-xqjh-59ww-r864.json create mode 100644 advisories/unreviewed/2025/04/GHSA-xrm4-vc7m-v28j/GHSA-xrm4-vc7m-v28j.json diff --git a/advisories/unreviewed/2023/01/GHSA-q4cw-h889-p6jj/GHSA-q4cw-h889-p6jj.json b/advisories/unreviewed/2023/01/GHSA-q4cw-h889-p6jj/GHSA-q4cw-h889-p6jj.json index b575eed55de..ba930cc73f4 100644 --- a/advisories/unreviewed/2023/01/GHSA-q4cw-h889-p6jj/GHSA-q4cw-h889-p6jj.json +++ b/advisories/unreviewed/2023/01/GHSA-q4cw-h889-p6jj/GHSA-q4cw-h889-p6jj.json @@ -27,6 +27,7 @@ "database_specific": { "cwe_ids": [ "CWE-20", + "CWE-290", "CWE-293" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2024/04/GHSA-fqrj-wwq6-q94w/GHSA-fqrj-wwq6-q94w.json b/advisories/unreviewed/2024/04/GHSA-fqrj-wwq6-q94w/GHSA-fqrj-wwq6-q94w.json index 09aed45014d..1c83a7965a0 100644 --- a/advisories/unreviewed/2024/04/GHSA-fqrj-wwq6-q94w/GHSA-fqrj-wwq6-q94w.json +++ b/advisories/unreviewed/2024/04/GHSA-fqrj-wwq6-q94w/GHSA-fqrj-wwq6-q94w.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-89" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-rfj8-v7wf-3hfc/GHSA-rfj8-v7wf-3hfc.json b/advisories/unreviewed/2024/04/GHSA-rfj8-v7wf-3hfc/GHSA-rfj8-v7wf-3hfc.json index 9ec9674e190..f5ad2d236e5 100644 --- a/advisories/unreviewed/2024/04/GHSA-rfj8-v7wf-3hfc/GHSA-rfj8-v7wf-3hfc.json +++ b/advisories/unreviewed/2024/04/GHSA-rfj8-v7wf-3hfc/GHSA-rfj8-v7wf-3hfc.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-352" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/12/GHSA-c382-wfjm-cr9h/GHSA-c382-wfjm-cr9h.json b/advisories/unreviewed/2024/12/GHSA-c382-wfjm-cr9h/GHSA-c382-wfjm-cr9h.json index 0e092a6e609..5744297690d 100644 --- a/advisories/unreviewed/2024/12/GHSA-c382-wfjm-cr9h/GHSA-c382-wfjm-cr9h.json +++ b/advisories/unreviewed/2024/12/GHSA-c382-wfjm-cr9h/GHSA-c382-wfjm-cr9h.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/04/GHSA-23rf-wq7x-gvq7/GHSA-23rf-wq7x-gvq7.json b/advisories/unreviewed/2025/04/GHSA-23rf-wq7x-gvq7/GHSA-23rf-wq7x-gvq7.json new file mode 100644 index 00000000000..5e5922a85b4 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-23rf-wq7x-gvq7/GHSA-23rf-wq7x-gvq7.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-23rf-wq7x-gvq7", + "modified": "2025-04-07T15:31:12Z", + "published": "2025-04-07T15:31:11Z", + "aliases": [ + "CVE-2024-52322" + ], + "details": "WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\n\nSpecifically WebService::Xero uses the Data::Random library which specifically states that it is \"Useful mostly for test programs\". Data::Random uses the rand() function.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52322" + }, + { + "type": "WEB", + "url": "https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537" + }, + { + "type": "WEB", + "url": "https://metacpan.org/release/LOCALSHOP/WebService-Xero-0.11/source/lib/WebService/Xero/Agent.pm#L17" + }, + { + "type": "WEB", + "url": "https://metacpan.org/release/LOCALSHOP/WebService-Xero-0.11/source/lib/WebService/Xero/Agent.pm#L178" + }, + { + "type": "WEB", + "url": "https://metacpan.org/release/LOCALSHOP/WebService-Xero-0.11/source/lib/WebService/Xero/Agent/PublicApplication.pm#L13" + }, + { + "type": "WEB", + "url": "https://metacpan.org/release/LOCALSHOP/WebService-Xero-0.11/source/lib/WebService/Xero/Agent/PublicApplication.pm#L93" + }, + { + "type": "WEB", + "url": "https://perldoc.perl.org/functions/rand" + }, + { + "type": "WEB", + "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-338" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T17:15:39Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-2749-6w3x-fm28/GHSA-2749-6w3x-fm28.json b/advisories/unreviewed/2025/04/GHSA-2749-6w3x-fm28/GHSA-2749-6w3x-fm28.json new file mode 100644 index 00000000000..e6a5e433cc0 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-2749-6w3x-fm28/GHSA-2749-6w3x-fm28.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2749-6w3x-fm28", + "modified": "2025-04-07T15:31:09Z", + "published": "2025-04-07T15:31:09Z", + "aliases": [ + "CVE-2025-1500" + ], + "details": "IBM Maximo Application Suite 9.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1500" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7230140" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T01:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-2c38-3wjv-55hm/GHSA-2c38-3wjv-55hm.json b/advisories/unreviewed/2025/04/GHSA-2c38-3wjv-55hm/GHSA-2c38-3wjv-55hm.json new file mode 100644 index 00000000000..6501018d46e --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-2c38-3wjv-55hm/GHSA-2c38-3wjv-55hm.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2c38-3wjv-55hm", + "modified": "2025-04-07T15:31:10Z", + "published": "2025-04-07T15:31:10Z", + "aliases": [ + "CVE-2025-3298" + ], + "details": "A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product of the component Registration Handler. The manipulation of the argument email leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3298" + }, + { + "type": "WEB", + "url": "https://github.com/foreverfeifei/cve/blob/main/user.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303493" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303493" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.550010" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T11:15:40Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-2cq5-j9m5-v929/GHSA-2cq5-j9m5-v929.json b/advisories/unreviewed/2025/04/GHSA-2cq5-j9m5-v929/GHSA-2cq5-j9m5-v929.json new file mode 100644 index 00000000000..d98760f3878 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-2cq5-j9m5-v929/GHSA-2cq5-j9m5-v929.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2cq5-j9m5-v929", + "modified": "2025-04-07T15:31:14Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-3328" + ], + "details": "A vulnerability was found in Tenda AC1206 15.03.06.23. It has been classified as critical. Affected is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid/timeZone leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3328" + }, + { + "type": "WEB", + "url": "https://github.com/CH13hh/tmp_store_cc/blob/main/AC1206/AC1206form_fast_setting_wifi_set/form_fast_setting_wifi_set.md" + }, + { + "type": "WEB", + "url": "https://github.com/CH13hh/tmp_store_cc/blob/main/AC1206/AC1206form_fast_setting_wifi_set_time/time.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303540" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303540" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.551893" + }, + { + "type": "WEB", + "url": "https://www.tenda.com.cn" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T01:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-2f7m-9j2c-gwvw/GHSA-2f7m-9j2c-gwvw.json b/advisories/unreviewed/2025/04/GHSA-2f7m-9j2c-gwvw/GHSA-2f7m-9j2c-gwvw.json index be2acece52f..189df16bcb2 100644 --- a/advisories/unreviewed/2025/04/GHSA-2f7m-9j2c-gwvw/GHSA-2f7m-9j2c-gwvw.json +++ b/advisories/unreviewed/2025/04/GHSA-2f7m-9j2c-gwvw/GHSA-2f7m-9j2c-gwvw.json @@ -33,7 +33,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-787" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/04/GHSA-2ggh-pp2g-4gr9/GHSA-2ggh-pp2g-4gr9.json b/advisories/unreviewed/2025/04/GHSA-2ggh-pp2g-4gr9/GHSA-2ggh-pp2g-4gr9.json new file mode 100644 index 00000000000..4e1a9ac7ef2 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-2ggh-pp2g-4gr9/GHSA-2ggh-pp2g-4gr9.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2ggh-pp2g-4gr9", + "modified": "2025-04-07T15:31:09Z", + "published": "2025-04-07T15:31:09Z", + "aliases": [ + "CVE-2025-2544" + ], + "details": "The AI Content Pipelines plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2544" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/ai-content-pipelines/tags/1.6/includes/generate-scheduled-content.php#L42" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/ai-content-pipelines/tags/1.6/includes/generate-scheduled-content.php#L44" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/ai-content-pipelines/tags/1.6/includes/generate-scheduled-content.php#L47" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/ai-content-pipelines/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b93214ec-5738-4f10-b48c-1d74aad52acb?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T02:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-33q9-fp3q-fw2p/GHSA-33q9-fp3q-fw2p.json b/advisories/unreviewed/2025/04/GHSA-33q9-fp3q-fw2p/GHSA-33q9-fp3q-fw2p.json new file mode 100644 index 00000000000..fc004c02ceb --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-33q9-fp3q-fw2p/GHSA-33q9-fp3q-fw2p.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-33q9-fp3q-fw2p", + "modified": "2025-04-07T15:31:15Z", + "published": "2025-04-07T15:31:15Z", + "aliases": [ + "CVE-2025-27534" + ], + "details": "in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27534" + }, + { + "type": "WEB", + "url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T03:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-3435-f6h9-64p7/GHSA-3435-f6h9-64p7.json b/advisories/unreviewed/2025/04/GHSA-3435-f6h9-64p7/GHSA-3435-f6h9-64p7.json new file mode 100644 index 00000000000..cddeae3de2b --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-3435-f6h9-64p7/GHSA-3435-f6h9-64p7.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3435-f6h9-64p7", + "modified": "2025-04-07T15:31:21Z", + "published": "2025-04-07T15:31:21Z", + "aliases": [ + "CVE-2025-3360" + ], + "details": "A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3360" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2025-3360" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357754" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T13:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-3qpr-rxgf-wxq6/GHSA-3qpr-rxgf-wxq6.json b/advisories/unreviewed/2025/04/GHSA-3qpr-rxgf-wxq6/GHSA-3qpr-rxgf-wxq6.json new file mode 100644 index 00000000000..cde47632fe1 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-3qpr-rxgf-wxq6/GHSA-3qpr-rxgf-wxq6.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3qpr-rxgf-wxq6", + "modified": "2025-04-07T15:31:15Z", + "published": "2025-04-07T15:31:15Z", + "aliases": [ + "CVE-2025-25057" + ], + "details": "in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25057" + }, + { + "type": "WEB", + "url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-401" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T03:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-4q3j-j6j7-qr2f/GHSA-4q3j-j6j7-qr2f.json b/advisories/unreviewed/2025/04/GHSA-4q3j-j6j7-qr2f/GHSA-4q3j-j6j7-qr2f.json new file mode 100644 index 00000000000..d819a205faf --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-4q3j-j6j7-qr2f/GHSA-4q3j-j6j7-qr2f.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4q3j-j6j7-qr2f", + "modified": "2025-04-07T15:31:10Z", + "published": "2025-04-07T15:31:10Z", + "aliases": [ + "CVE-2025-3299" + ], + "details": "A vulnerability was found in PHPGurukul Men Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /appointment.php. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3299" + }, + { + "type": "WEB", + "url": "https://github.com/LaneyYu/cve/issues/1" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303494" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303494" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.550185" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T11:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-4x43-w54x-gjc8/GHSA-4x43-w54x-gjc8.json b/advisories/unreviewed/2025/04/GHSA-4x43-w54x-gjc8/GHSA-4x43-w54x-gjc8.json new file mode 100644 index 00000000000..1a98112ac80 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-4x43-w54x-gjc8/GHSA-4x43-w54x-gjc8.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4x43-w54x-gjc8", + "modified": "2025-04-07T15:31:14Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-3324" + ], + "details": "A vulnerability, which was classified as critical, has been found in godcheese/code-projects Nimrod 0.8. Affected by this issue is some unknown functionality of the file FileRestController.java. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3324" + }, + { + "type": "WEB", + "url": "https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/Nimrod-fileUpload.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303536" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303536" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.551864" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-06T23:15:39Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-527p-356f-cgq4/GHSA-527p-356f-cgq4.json b/advisories/unreviewed/2025/04/GHSA-527p-356f-cgq4/GHSA-527p-356f-cgq4.json new file mode 100644 index 00000000000..418981b8a5a --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-527p-356f-cgq4/GHSA-527p-356f-cgq4.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-527p-356f-cgq4", + "modified": "2025-04-07T15:31:14Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-3329" + ], + "details": "A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Restaurant Order Handler. The manipulation of the argument Login/Password leads to cleartext transmission of sensitive information. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3329" + }, + { + "type": "WEB", + "url": "https://medium.com/@davimouar/from-order-to-exploit-a-deep-dive-into-restaurant-network-security-64aeaf3a6f64" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303543" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303543" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.551790" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T01:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-5hjr-4ff9-h4hx/GHSA-5hjr-4ff9-h4hx.json b/advisories/unreviewed/2025/04/GHSA-5hjr-4ff9-h4hx/GHSA-5hjr-4ff9-h4hx.json new file mode 100644 index 00000000000..d274d7691f4 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-5hjr-4ff9-h4hx/GHSA-5hjr-4ff9-h4hx.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5hjr-4ff9-h4hx", + "modified": "2025-04-07T15:31:15Z", + "published": "2025-04-07T15:31:15Z", + "aliases": [ + "CVE-2025-22842" + ], + "details": "in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22842" + }, + { + "type": "WEB", + "url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T03:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-5px6-qr34-v59r/GHSA-5px6-qr34-v59r.json b/advisories/unreviewed/2025/04/GHSA-5px6-qr34-v59r/GHSA-5px6-qr34-v59r.json new file mode 100644 index 00000000000..b3b848ffec3 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-5px6-qr34-v59r/GHSA-5px6-qr34-v59r.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5px6-qr34-v59r", + "modified": "2025-04-07T15:31:14Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-3308" + ], + "details": "A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /viewrequest.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3308" + }, + { + "type": "WEB", + "url": "https://github.com/p1026/CVE/issues/25" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303505" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303505" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.550193" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-06T04:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-6839-6896-r9mx/GHSA-6839-6896-r9mx.json b/advisories/unreviewed/2025/04/GHSA-6839-6896-r9mx/GHSA-6839-6896-r9mx.json new file mode 100644 index 00000000000..2e905952bdc --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-6839-6896-r9mx/GHSA-6839-6896-r9mx.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6839-6896-r9mx", + "modified": "2025-04-07T15:31:21Z", + "published": "2025-04-07T15:31:21Z", + "aliases": [ + "CVE-2025-2251" + ], + "details": "A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2251" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2025-2251" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2351678" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T14:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-69gq-2xc5-f33j/GHSA-69gq-2xc5-f33j.json b/advisories/unreviewed/2025/04/GHSA-69gq-2xc5-f33j/GHSA-69gq-2xc5-f33j.json new file mode 100644 index 00000000000..dded28a0eeb --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-69gq-2xc5-f33j/GHSA-69gq-2xc5-f33j.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-69gq-2xc5-f33j", + "modified": "2025-04-07T15:31:12Z", + "published": "2025-04-07T15:31:11Z", + "aliases": [ + "CVE-2025-32364" + ], + "details": "A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32364" + }, + { + "type": "WEB", + "url": "https://gitlab.freedesktop.org/poppler/poppler/-/commit/d87bc726c7cc98f8c26b60ece5f20236e9de1bc3" + }, + { + "type": "WEB", + "url": "https://gitlab.freedesktop.org/poppler/poppler/-/issues/1574" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T22:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-6r9p-wm3j-2fmc/GHSA-6r9p-wm3j-2fmc.json b/advisories/unreviewed/2025/04/GHSA-6r9p-wm3j-2fmc/GHSA-6r9p-wm3j-2fmc.json new file mode 100644 index 00000000000..1989f68d75e --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-6r9p-wm3j-2fmc/GHSA-6r9p-wm3j-2fmc.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6r9p-wm3j-2fmc", + "modified": "2025-04-07T15:31:15Z", + "published": "2025-04-07T15:31:15Z", + "aliases": [ + "CVE-2025-3332" + ], + "details": "A vulnerability, which was classified as critical, was found in codeprojects Online Restaurant Management System 1.0. Affected is an unknown function of the file /admin/menu_save.php. The manipulation of the argument menu leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3332" + }, + { + "type": "WEB", + "url": "https://github.com/p1026/CVE/issues/46" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303546" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303546" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.551906" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T03:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-6vqr-8xjq-ghqg/GHSA-6vqr-8xjq-ghqg.json b/advisories/unreviewed/2025/04/GHSA-6vqr-8xjq-ghqg/GHSA-6vqr-8xjq-ghqg.json index 6b91f6bbbcd..0595ad6fcb6 100644 --- a/advisories/unreviewed/2025/04/GHSA-6vqr-8xjq-ghqg/GHSA-6vqr-8xjq-ghqg.json +++ b/advisories/unreviewed/2025/04/GHSA-6vqr-8xjq-ghqg/GHSA-6vqr-8xjq-ghqg.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-6vqr-8xjq-ghqg", - "modified": "2025-04-07T06:30:27Z", + "modified": "2025-04-07T15:31:15Z", "published": "2025-04-07T06:30:27Z", "aliases": [ "CVE-2025-20656" ], "details": "In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09625423; Issue ID: MSV-3033.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-787" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-07T04:15:19Z" diff --git a/advisories/unreviewed/2025/04/GHSA-779c-58c4-6v6c/GHSA-779c-58c4-6v6c.json b/advisories/unreviewed/2025/04/GHSA-779c-58c4-6v6c/GHSA-779c-58c4-6v6c.json new file mode 100644 index 00000000000..15fa7608190 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-779c-58c4-6v6c/GHSA-779c-58c4-6v6c.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-779c-58c4-6v6c", + "modified": "2025-04-07T15:31:22Z", + "published": "2025-04-07T15:31:21Z", + "aliases": [ + "CVE-2025-3359" + ], + "details": "A flaw was found in GNUPlot. A segmentation fault via IO_str_init_static_internal may jeopardize the environment.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3359" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2025-3359" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357749" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-754" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T13:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-77wp-9m8w-r2j3/GHSA-77wp-9m8w-r2j3.json b/advisories/unreviewed/2025/04/GHSA-77wp-9m8w-r2j3/GHSA-77wp-9m8w-r2j3.json new file mode 100644 index 00000000000..ae9f3fcca4b --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-77wp-9m8w-r2j3/GHSA-77wp-9m8w-r2j3.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-77wp-9m8w-r2j3", + "modified": "2025-04-07T15:31:14Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-3326" + ], + "details": "A vulnerability has been found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This vulnerability affects unknown code of the file /common/upload of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3326" + }, + { + "type": "WEB", + "url": "https://github.com/uglory-gll/javasec/blob/main/iboot.md#2file-upload" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303538" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303538" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.551870" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T00:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-7r4x-ff5h-ghvg/GHSA-7r4x-ff5h-ghvg.json b/advisories/unreviewed/2025/04/GHSA-7r4x-ff5h-ghvg/GHSA-7r4x-ff5h-ghvg.json new file mode 100644 index 00000000000..7c278d57019 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-7r4x-ff5h-ghvg/GHSA-7r4x-ff5h-ghvg.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7r4x-ff5h-ghvg", + "modified": "2025-04-07T15:31:14Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-3325" + ], + "details": "A vulnerability, which was classified as problematic, was found in iteaj iboot 物联网网关 1.1.3. This affects an unknown part of the file /core/admin/pwd of the component Admin Password Handler. The manipulation of the argument ID leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3325" + }, + { + "type": "WEB", + "url": "https://github.com/uglory-gll/javasec/blob/main/iboot.md#1logical-loopholes" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303537" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303537" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.551869" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-06T23:15:39Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-8359-6xxw-qm22/GHSA-8359-6xxw-qm22.json b/advisories/unreviewed/2025/04/GHSA-8359-6xxw-qm22/GHSA-8359-6xxw-qm22.json index 445247dea68..b73bc3f22c3 100644 --- a/advisories/unreviewed/2025/04/GHSA-8359-6xxw-qm22/GHSA-8359-6xxw-qm22.json +++ b/advisories/unreviewed/2025/04/GHSA-8359-6xxw-qm22/GHSA-8359-6xxw-qm22.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-8359-6xxw-qm22", - "modified": "2025-04-07T06:30:28Z", + "modified": "2025-04-07T15:31:15Z", "published": "2025-04-07T06:30:27Z", "aliases": [ "CVE-2025-20659" ], "details": "In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01519028; Issue ID: MSV-2768.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-125" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-07T04:15:19Z" diff --git a/advisories/unreviewed/2025/04/GHSA-88rv-3gw6-829j/GHSA-88rv-3gw6-829j.json b/advisories/unreviewed/2025/04/GHSA-88rv-3gw6-829j/GHSA-88rv-3gw6-829j.json index ef29e64bab6..7691149790e 100644 --- a/advisories/unreviewed/2025/04/GHSA-88rv-3gw6-829j/GHSA-88rv-3gw6-829j.json +++ b/advisories/unreviewed/2025/04/GHSA-88rv-3gw6-829j/GHSA-88rv-3gw6-829j.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-88rv-3gw6-829j", - "modified": "2025-04-04T18:30:55Z", + "modified": "2025-04-07T15:31:01Z", "published": "2025-04-04T18:30:55Z", "aliases": [ "CVE-2025-0468" ], "details": "Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.\n\nUnder certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-280" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-04T16:15:17Z" diff --git a/advisories/unreviewed/2025/04/GHSA-9867-8p52-837m/GHSA-9867-8p52-837m.json b/advisories/unreviewed/2025/04/GHSA-9867-8p52-837m/GHSA-9867-8p52-837m.json new file mode 100644 index 00000000000..a9208ae6d93 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-9867-8p52-837m/GHSA-9867-8p52-837m.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9867-8p52-837m", + "modified": "2025-04-07T15:31:15Z", + "published": "2025-04-07T15:31:15Z", + "aliases": [ + "CVE-2025-3333" + ], + "details": "A vulnerability has been found in codeprojects Online Restaurant Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/menu_update.php. The manipulation of the argument menu leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3333" + }, + { + "type": "WEB", + "url": "https://github.com/p1026/CVE/issues/47" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303547" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303547" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.551907" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T03:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-9j63-jqr8-fh2v/GHSA-9j63-jqr8-fh2v.json b/advisories/unreviewed/2025/04/GHSA-9j63-jqr8-fh2v/GHSA-9j63-jqr8-fh2v.json new file mode 100644 index 00000000000..5117e916c08 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-9j63-jqr8-fh2v/GHSA-9j63-jqr8-fh2v.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9j63-jqr8-fh2v", + "modified": "2025-04-07T15:31:12Z", + "published": "2025-04-07T15:31:12Z", + "aliases": [ + "CVE-2025-32366" + ], + "details": "In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and memcpy(response+offset,*end,*rdlen).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32366" + }, + { + "type": "WEB", + "url": "https://web.git.kernel.org/pub/scm/network/connman/connman.git/tree/src/dnsproxy.c?h=1.44#n1001" + }, + { + "type": "WEB", + "url": "https://web.git.kernel.org/pub/scm/network/connman/connman.git/tree/src/dnsproxy.c?h=1.44#n988" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-130" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T23:15:40Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-9rx6-r638-rfhr/GHSA-9rx6-r638-rfhr.json b/advisories/unreviewed/2025/04/GHSA-9rx6-r638-rfhr/GHSA-9rx6-r638-rfhr.json new file mode 100644 index 00000000000..396a5c26d56 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-9rx6-r638-rfhr/GHSA-9rx6-r638-rfhr.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9rx6-r638-rfhr", + "modified": "2025-04-07T15:30:54Z", + "published": "2025-04-07T15:30:54Z", + "aliases": [ + "CVE-2025-3172" + ], + "details": "A vulnerability, which was classified as critical, has been found in Project Worlds Online Lawyer Management System 1.0. This issue affects some unknown processing of the file /lawyer_booking.php. The manipulation of the argument unblock_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3172" + }, + { + "type": "WEB", + "url": "https://github.com/p1026/CVE/issues/6" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303131" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303131" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.543274" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-03T18:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-9xjh-c5x2-3cqm/GHSA-9xjh-c5x2-3cqm.json b/advisories/unreviewed/2025/04/GHSA-9xjh-c5x2-3cqm/GHSA-9xjh-c5x2-3cqm.json new file mode 100644 index 00000000000..9b8b7ca1361 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-9xjh-c5x2-3cqm/GHSA-9xjh-c5x2-3cqm.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9xjh-c5x2-3cqm", + "modified": "2025-04-07T15:31:14Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-3307" + ], + "details": "A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /reset.php. The manipulation of the argument useremail leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3307" + }, + { + "type": "WEB", + "url": "https://github.com/p1026/CVE/issues/24" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303504" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303504" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.550192" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-06T03:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-c662-cq7c-gxxm/GHSA-c662-cq7c-gxxm.json b/advisories/unreviewed/2025/04/GHSA-c662-cq7c-gxxm/GHSA-c662-cq7c-gxxm.json new file mode 100644 index 00000000000..459a679ee13 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-c662-cq7c-gxxm/GHSA-c662-cq7c-gxxm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c662-cq7c-gxxm", + "modified": "2025-04-07T15:31:15Z", + "published": "2025-04-07T15:31:15Z", + "aliases": [ + "CVE-2025-24304" + ], + "details": "in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds write.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24304" + }, + { + "type": "WEB", + "url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T03:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-c7w9-6gg4-jgw9/GHSA-c7w9-6gg4-jgw9.json b/advisories/unreviewed/2025/04/GHSA-c7w9-6gg4-jgw9/GHSA-c7w9-6gg4-jgw9.json new file mode 100644 index 00000000000..b5e1a649103 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-c7w9-6gg4-jgw9/GHSA-c7w9-6gg4-jgw9.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c7w9-6gg4-jgw9", + "modified": "2025-04-07T15:31:13Z", + "published": "2025-04-07T15:31:13Z", + "aliases": [ + "CVE-2024-58132" + ], + "details": "In chainmaker-go (aka ChainMaker) before 2.3.6, multiple updates to a single node's configuration can cause other normal nodes to perform concurrent read and write operations on a map, leading to a panic.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58132" + }, + { + "type": "WEB", + "url": "https://git.chainmaker.org.cn/chainmaker/issue/-/issues/1202" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-821" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-06T03:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-c995-4fw3-j39m/GHSA-c995-4fw3-j39m.json b/advisories/unreviewed/2025/04/GHSA-c995-4fw3-j39m/GHSA-c995-4fw3-j39m.json new file mode 100644 index 00000000000..47d966182e3 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-c995-4fw3-j39m/GHSA-c995-4fw3-j39m.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c995-4fw3-j39m", + "modified": "2025-04-07T15:31:22Z", + "published": "2025-04-07T15:31:22Z", + "aliases": [ + "CVE-2025-3248" + ], + "details": "Langflow versions prior to 1.3.0 are susceptible to code injection in \nthe /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary\ncode.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3248" + }, + { + "type": "WEB", + "url": "https://github.com/langflow-ai/langflow/pull/6911" + }, + { + "type": "WEB", + "url": "https://github.com/langflow-ai/langflow/releases/tag/1.3.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-306" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T15:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-c9h5-c8wm-8m25/GHSA-c9h5-c8wm-8m25.json b/advisories/unreviewed/2025/04/GHSA-c9h5-c8wm-8m25/GHSA-c9h5-c8wm-8m25.json new file mode 100644 index 00000000000..0a43379b160 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-c9h5-c8wm-8m25/GHSA-c9h5-c8wm-8m25.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c9h5-c8wm-8m25", + "modified": "2025-04-07T15:31:15Z", + "published": "2025-04-07T15:31:15Z", + "aliases": [ + "CVE-2025-22851" + ], + "details": "in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22851" + }, + { + "type": "WEB", + "url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T03:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-ch4m-2996-7xpv/GHSA-ch4m-2996-7xpv.json b/advisories/unreviewed/2025/04/GHSA-ch4m-2996-7xpv/GHSA-ch4m-2996-7xpv.json new file mode 100644 index 00000000000..80649bbb3ae --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-ch4m-2996-7xpv/GHSA-ch4m-2996-7xpv.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ch4m-2996-7xpv", + "modified": "2025-04-07T15:31:10Z", + "published": "2025-04-07T15:31:10Z", + "aliases": [ + "CVE-2024-57835" + ], + "details": "Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values. \n\nString::Random defaults to Perl's built-in predictable random number generator, the rand() function, which is not cryptographically secure", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57835" + }, + { + "type": "WEB", + "url": "https://metacpan.org/release/SHLOMIF/String-Random-0.32/source/lib/String/Random.pm#L377" + }, + { + "type": "WEB", + "url": "https://metacpan.org/release/TANIGUCHI/Amon2-Auth-Site-LINE-0.04/source/lib/Amon2/Auth/Site/LINE.pm#L235" + }, + { + "type": "WEB", + "url": "https://metacpan.org/release/TANIGUCHI/Amon2-Auth-Site-LINE-0.04/source/lib/Amon2/Auth/Site/LINE.pm#L255" + }, + { + "type": "WEB", + "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-338" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T16:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-chv8-32cq-8ghq/GHSA-chv8-32cq-8ghq.json b/advisories/unreviewed/2025/04/GHSA-chv8-32cq-8ghq/GHSA-chv8-32cq-8ghq.json index 69488a410ec..e103a421f98 100644 --- a/advisories/unreviewed/2025/04/GHSA-chv8-32cq-8ghq/GHSA-chv8-32cq-8ghq.json +++ b/advisories/unreviewed/2025/04/GHSA-chv8-32cq-8ghq/GHSA-chv8-32cq-8ghq.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-chv8-32cq-8ghq", - "modified": "2025-04-03T21:32:59Z", + "modified": "2025-04-07T15:30:54Z", "published": "2025-04-03T21:32:59Z", "aliases": [ "CVE-2025-29462" ], "details": "A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13. The vulnerability occurs when the webCgiGetUploadFile function calls the socketRead function to process HTTP request messages, resulting in the overwriting of a buffer on the stack.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-120" + ], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-03T20:15:24Z" diff --git a/advisories/unreviewed/2025/04/GHSA-f3r5-jm79-fwqg/GHSA-f3r5-jm79-fwqg.json b/advisories/unreviewed/2025/04/GHSA-f3r5-jm79-fwqg/GHSA-f3r5-jm79-fwqg.json new file mode 100644 index 00000000000..9ff0faf42cd --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-f3r5-jm79-fwqg/GHSA-f3r5-jm79-fwqg.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f3r5-jm79-fwqg", + "modified": "2025-04-07T15:31:14Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-20102" + ], + "details": "in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20102" + }, + { + "type": "WEB", + "url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T03:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-f5jv-rh3p-2g3q/GHSA-f5jv-rh3p-2g3q.json b/advisories/unreviewed/2025/04/GHSA-f5jv-rh3p-2g3q/GHSA-f5jv-rh3p-2g3q.json new file mode 100644 index 00000000000..470a0998d0e --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-f5jv-rh3p-2g3q/GHSA-f5jv-rh3p-2g3q.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f5jv-rh3p-2g3q", + "modified": "2025-04-07T15:31:09Z", + "published": "2025-04-07T15:31:09Z", + "aliases": [ + "CVE-2025-0810" + ], + "details": "The Read More & Accordion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.5. This is due to missing or incorrect nonce validation on the addNewButtons() function. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0810" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMoreInit.php#L122" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMorePages.php#L59" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMorePages.php#L82" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a963cd9b-9f8f-4bd2-92cd-74c5e85e1d96?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T02:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-f8pp-r5jc-65w2/GHSA-f8pp-r5jc-65w2.json b/advisories/unreviewed/2025/04/GHSA-f8pp-r5jc-65w2/GHSA-f8pp-r5jc-65w2.json new file mode 100644 index 00000000000..7b258228b3c --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-f8pp-r5jc-65w2/GHSA-f8pp-r5jc-65w2.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f8pp-r5jc-65w2", + "modified": "2025-04-07T15:31:15Z", + "published": "2025-04-07T15:31:15Z", + "aliases": [ + "CVE-2025-22452" + ], + "details": "in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22452" + }, + { + "type": "WEB", + "url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T03:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-f9r4-j32j-wpx3/GHSA-f9r4-j32j-wpx3.json b/advisories/unreviewed/2025/04/GHSA-f9r4-j32j-wpx3/GHSA-f9r4-j32j-wpx3.json index 683a1d12f4a..4f0a7c12d5a 100644 --- a/advisories/unreviewed/2025/04/GHSA-f9r4-j32j-wpx3/GHSA-f9r4-j32j-wpx3.json +++ b/advisories/unreviewed/2025/04/GHSA-f9r4-j32j-wpx3/GHSA-f9r4-j32j-wpx3.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-f9r4-j32j-wpx3", - "modified": "2025-04-07T06:30:27Z", + "modified": "2025-04-07T15:31:16Z", "published": "2025-04-07T06:30:27Z", "aliases": [ "CVE-2025-20662" ], "details": "In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: DTV04428276; Issue ID: MSV-3184.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-125" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-07T04:15:20Z" diff --git a/advisories/unreviewed/2025/04/GHSA-fv2f-q5hc-738w/GHSA-fv2f-q5hc-738w.json b/advisories/unreviewed/2025/04/GHSA-fv2f-q5hc-738w/GHSA-fv2f-q5hc-738w.json new file mode 100644 index 00000000000..dabe7e97e62 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-fv2f-q5hc-738w/GHSA-fv2f-q5hc-738w.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fv2f-q5hc-738w", + "modified": "2025-04-07T15:31:14Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-3327" + ], + "details": "A vulnerability was found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This issue affects some unknown processing of the file /common/upload/batch of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3327" + }, + { + "type": "WEB", + "url": "https://github.com/uglory-gll/javasec/blob/main/iboot.md#22commonuploadbatch-arbitrary-file-upload" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303539" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303539" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.551871" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T01:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-gfj4-2p4p-m25j/GHSA-gfj4-2p4p-m25j.json b/advisories/unreviewed/2025/04/GHSA-gfj4-2p4p-m25j/GHSA-gfj4-2p4p-m25j.json new file mode 100644 index 00000000000..701dfaf9dd0 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-gfj4-2p4p-m25j/GHSA-gfj4-2p4p-m25j.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gfj4-2p4p-m25j", + "modified": "2025-04-07T15:31:11Z", + "published": "2025-04-07T15:31:10Z", + "aliases": [ + "CVE-2024-57868" + ], + "details": "Web::API 2.8 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\n\nSpecifically Web::API uses the Data::Random library which specifically states that it is \"Useful mostly for test programs\". Data::Random uses the rand() function.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57868" + }, + { + "type": "WEB", + "url": "https://metacpan.org/dist/Web-API/source/lib/Web/API.pm#L20" + }, + { + "type": "WEB", + "url": "https://metacpan.org/dist/Web-API/source/lib/Web/API.pm#L348" + }, + { + "type": "WEB", + "url": "https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537" + }, + { + "type": "WEB", + "url": "https://perldoc.perl.org/functions/rand" + }, + { + "type": "WEB", + "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-338" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T16:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-h335-fwrx-9fx8/GHSA-h335-fwrx-9fx8.json b/advisories/unreviewed/2025/04/GHSA-h335-fwrx-9fx8/GHSA-h335-fwrx-9fx8.json new file mode 100644 index 00000000000..e7be8f37ca2 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-h335-fwrx-9fx8/GHSA-h335-fwrx-9fx8.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h335-fwrx-9fx8", + "modified": "2025-04-07T15:31:09Z", + "published": "2025-04-07T15:31:09Z", + "aliases": [ + "CVE-2024-13604" + ], + "details": "The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.4 via the 'kbs' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 1.7.3.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13604" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/files.php" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3231596" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a058d6-ca9e-4241-b6dd-307efa7689ab?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T02:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-hp4v-q7qc-45wr/GHSA-hp4v-q7qc-45wr.json b/advisories/unreviewed/2025/04/GHSA-hp4v-q7qc-45wr/GHSA-hp4v-q7qc-45wr.json new file mode 100644 index 00000000000..5f90a43cdf6 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-hp4v-q7qc-45wr/GHSA-hp4v-q7qc-45wr.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hp4v-q7qc-45wr", + "modified": "2025-04-07T15:31:10Z", + "published": "2025-04-07T15:31:10Z", + "aliases": [ + "CVE-2025-30401" + ], + "details": "A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30401" + }, + { + "type": "WEB", + "url": "https://www.facebook.com/security/advisories/cve-2025-30401" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T12:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-hpcf-gj4m-m22c/GHSA-hpcf-gj4m-m22c.json b/advisories/unreviewed/2025/04/GHSA-hpcf-gj4m-m22c/GHSA-hpcf-gj4m-m22c.json new file mode 100644 index 00000000000..03dc2e96cc6 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-hpcf-gj4m-m22c/GHSA-hpcf-gj4m-m22c.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hpcf-gj4m-m22c", + "modified": "2025-04-07T15:31:10Z", + "published": "2025-04-07T15:31:10Z", + "aliases": [ + "CVE-2025-2941" + ], + "details": "The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the wc-upload-file[] parameter in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2941" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3266697%40drag-and-drop-multiple-file-upload-for-woocommerce&new=3266697%40drag-and-drop-multiple-file-upload-for-woocommerce&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-for-woocommerce/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2685a2b4-aba3-425b-af0d-06f7693ab3d7?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T07:15:40Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-hvmf-h8x8-34xp/GHSA-hvmf-h8x8-34xp.json b/advisories/unreviewed/2025/04/GHSA-hvmf-h8x8-34xp/GHSA-hvmf-h8x8-34xp.json new file mode 100644 index 00000000000..7ef35db09cf --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-hvmf-h8x8-34xp/GHSA-hvmf-h8x8-34xp.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hvmf-h8x8-34xp", + "modified": "2025-04-07T15:31:13Z", + "published": "2025-04-07T15:31:13Z", + "aliases": [ + "CVE-2025-3306" + ], + "details": "A vulnerability was found in code-projects Blood Bank Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /don.php. The manipulation of the argument fullname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3306" + }, + { + "type": "WEB", + "url": "https://github.com/p1026/CVE/issues/22" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303503" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303503" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.550190" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-06T01:15:40Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-hvwq-39r8-6778/GHSA-hvwq-39r8-6778.json b/advisories/unreviewed/2025/04/GHSA-hvwq-39r8-6778/GHSA-hvwq-39r8-6778.json new file mode 100644 index 00000000000..31089894d04 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-hvwq-39r8-6778/GHSA-hvwq-39r8-6778.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hvwq-39r8-6778", + "modified": "2025-04-07T15:31:09Z", + "published": "2025-04-07T15:31:09Z", + "aliases": [ + "CVE-2025-2933" + ], + "details": "The Email Notifications for Updates plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the awun_import_settings() function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2933" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3265589%40wp-update-mail-notification&new=3265589%40wp-update-mail-notification" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d52e644b-a58f-4e09-9e53-e9cbef75e34f?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T02:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-hx6m-xfx3-6p5x/GHSA-hx6m-xfx3-6p5x.json b/advisories/unreviewed/2025/04/GHSA-hx6m-xfx3-6p5x/GHSA-hx6m-xfx3-6p5x.json new file mode 100644 index 00000000000..71ec3d2eba9 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-hx6m-xfx3-6p5x/GHSA-hx6m-xfx3-6p5x.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hx6m-xfx3-6p5x", + "modified": "2025-04-07T15:31:11Z", + "published": "2025-04-07T15:31:11Z", + "aliases": [ + "CVE-2024-58036" + ], + "details": "Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\n\nSpecifically Net::Dropbox::API uses the Data::Random library which specifically states that it is \"Useful mostly for test programs\". Data::Random uses the rand() function.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58036" + }, + { + "type": "WEB", + "url": "https://metacpan.org/release/BAREFOOT/Data-Random-0.13/source/lib/Data/Random.pm#L537" + }, + { + "type": "WEB", + "url": "https://metacpan.org/release/NORBU/Net-Dropbox-API-1.9/source/lib/Net/Dropbox/API.pm#L11" + }, + { + "type": "WEB", + "url": "https://metacpan.org/release/NORBU/Net-Dropbox-API-1.9/source/lib/Net/Dropbox/API.pm#L385" + }, + { + "type": "WEB", + "url": "https://perldoc.perl.org/functions/rand" + }, + { + "type": "WEB", + "url": "https://security.metacpan.org/docs/guides/random-data-for-security.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-338" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T16:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-j882-wwwr-7r6q/GHSA-j882-wwwr-7r6q.json b/advisories/unreviewed/2025/04/GHSA-j882-wwwr-7r6q/GHSA-j882-wwwr-7r6q.json new file mode 100644 index 00000000000..43a760f61d9 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-j882-wwwr-7r6q/GHSA-j882-wwwr-7r6q.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j882-wwwr-7r6q", + "modified": "2025-04-07T15:31:13Z", + "published": "2025-04-07T15:31:13Z", + "aliases": [ + "CVE-2024-58131" + ], + "details": "FISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example, be observed when a malicious node (that has modified the codebase to allow a large min_seal_time value) joins a blockchain network.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58131" + }, + { + "type": "WEB", + "url": "https://github.com/FISCO-BCOS/FISCO-BCOS/issues/4656" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-821" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-06T03:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-jc96-wpqj-97v4/GHSA-jc96-wpqj-97v4.json b/advisories/unreviewed/2025/04/GHSA-jc96-wpqj-97v4/GHSA-jc96-wpqj-97v4.json new file mode 100644 index 00000000000..b4205c4cf7c --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-jc96-wpqj-97v4/GHSA-jc96-wpqj-97v4.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jc96-wpqj-97v4", + "modified": "2025-04-07T15:31:21Z", + "published": "2025-04-07T15:31:21Z", + "aliases": [ + "CVE-2025-3369" + ], + "details": "A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /novel/friendLink/list. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3369" + }, + { + "type": "WEB", + "url": "https://github.com/mapl3miss/novel-plusSQLi/blob/master/novelPLUS-sqli.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303614" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303614" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.552101" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T14:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-jv3r-2v53-4w3v/GHSA-jv3r-2v53-4w3v.json b/advisories/unreviewed/2025/04/GHSA-jv3r-2v53-4w3v/GHSA-jv3r-2v53-4w3v.json new file mode 100644 index 00000000000..56e0dca44d1 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-jv3r-2v53-4w3v/GHSA-jv3r-2v53-4w3v.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jv3r-2v53-4w3v", + "modified": "2025-04-07T15:31:14Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-3323" + ], + "details": "A vulnerability classified as critical was found in godcheese/code-projects Nimrod 0.8. Affected by this vulnerability is an unknown functionality of the file ViewMenuCategoryRestController.java. The manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3323" + }, + { + "type": "WEB", + "url": "https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/Nimrod-SQL.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303535" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303535" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.551863" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-06T22:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-jx87-jq84-246c/GHSA-jx87-jq84-246c.json b/advisories/unreviewed/2025/04/GHSA-jx87-jq84-246c/GHSA-jx87-jq84-246c.json new file mode 100644 index 00000000000..74131dfd9f0 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-jx87-jq84-246c/GHSA-jx87-jq84-246c.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jx87-jq84-246c", + "modified": "2025-04-07T15:31:15Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-3330" + ], + "details": "A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0. This vulnerability affects unknown code of the file /reservation_save.php. The manipulation of the argument first leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3330" + }, + { + "type": "WEB", + "url": "https://github.com/p1026/CVE/issues/44" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303544" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303544" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.551904" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T02:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-jxhv-99m9-3f9j/GHSA-jxhv-99m9-3f9j.json b/advisories/unreviewed/2025/04/GHSA-jxhv-99m9-3f9j/GHSA-jxhv-99m9-3f9j.json new file mode 100644 index 00000000000..55c073936b0 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-jxhv-99m9-3f9j/GHSA-jxhv-99m9-3f9j.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jxhv-99m9-3f9j", + "modified": "2025-04-07T15:31:12Z", + "published": "2025-04-07T15:31:12Z", + "aliases": [ + "CVE-2025-3305" + ], + "details": "A vulnerability has been found in 1902756969/code-projects IKUN_Library 1.0 and classified as problematic. This vulnerability affects the function addInterceptors of the file MvcConfig.java of the component Borrow Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3305" + }, + { + "type": "WEB", + "url": "https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/IKUN_Library-authority.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303502" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303502" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.550186" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T23:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-m9x3-4g44-fw28/GHSA-m9x3-4g44-fw28.json b/advisories/unreviewed/2025/04/GHSA-m9x3-4g44-fw28/GHSA-m9x3-4g44-fw28.json index 3617e450485..7bc2b0ad53c 100644 --- a/advisories/unreviewed/2025/04/GHSA-m9x3-4g44-fw28/GHSA-m9x3-4g44-fw28.json +++ b/advisories/unreviewed/2025/04/GHSA-m9x3-4g44-fw28/GHSA-m9x3-4g44-fw28.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-m9x3-4g44-fw28", - "modified": "2025-04-07T06:30:27Z", + "modified": "2025-04-07T15:31:16Z", "published": "2025-04-07T06:30:27Z", "aliases": [ "CVE-2025-20664" ], "details": "In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00406217; Issue ID: MSV-2773.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-248" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-07T04:15:20Z" diff --git a/advisories/unreviewed/2025/04/GHSA-mjv8-w698-v8wq/GHSA-mjv8-w698-v8wq.json b/advisories/unreviewed/2025/04/GHSA-mjv8-w698-v8wq/GHSA-mjv8-w698-v8wq.json index 3a94a5f3fd0..d3d8f9b85df 100644 --- a/advisories/unreviewed/2025/04/GHSA-mjv8-w698-v8wq/GHSA-mjv8-w698-v8wq.json +++ b/advisories/unreviewed/2025/04/GHSA-mjv8-w698-v8wq/GHSA-mjv8-w698-v8wq.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-mjv8-w698-v8wq", - "modified": "2025-04-07T06:30:27Z", + "modified": "2025-04-07T15:31:16Z", "published": "2025-04-07T06:30:27Z", "aliases": [ "CVE-2025-20663" ], "details": "In wlan AP driver, there is a possible information disclosure due to an uncaught exception. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00408868; Issue ID: MSV-3031.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-248" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-07T04:15:20Z" diff --git a/advisories/unreviewed/2025/04/GHSA-p53j-gw5m-pf4h/GHSA-p53j-gw5m-pf4h.json b/advisories/unreviewed/2025/04/GHSA-p53j-gw5m-pf4h/GHSA-p53j-gw5m-pf4h.json new file mode 100644 index 00000000000..ada88de53b6 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-p53j-gw5m-pf4h/GHSA-p53j-gw5m-pf4h.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p53j-gw5m-pf4h", + "modified": "2025-04-07T15:31:10Z", + "published": "2025-04-07T15:31:10Z", + "aliases": [ + "CVE-2025-3296" + ], + "details": "A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=delete_customer. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3296" + }, + { + "type": "WEB", + "url": "https://github.com/foreverfeifei/cve/blob/main/sql.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303491" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303491" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.549932" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T08:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-ph62-3p55-vjx4/GHSA-ph62-3p55-vjx4.json b/advisories/unreviewed/2025/04/GHSA-ph62-3p55-vjx4/GHSA-ph62-3p55-vjx4.json new file mode 100644 index 00000000000..b0003e0349f --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-ph62-3p55-vjx4/GHSA-ph62-3p55-vjx4.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ph62-3p55-vjx4", + "modified": "2025-04-07T15:31:21Z", + "published": "2025-04-07T15:31:21Z", + "aliases": [ + "CVE-2025-3370" + ], + "details": "A vulnerability classified as critical has been found in PHPGurukul Men Salon Management System 1.0. This affects an unknown part of the file /admin/admin-profile.php. The manipulation of the argument contactnumber leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3370" + }, + { + "type": "WEB", + "url": "https://github.com/1SHOTSEC/CVE/issues/1" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303615" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303615" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.552172" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T14:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-pw3g-hp64-xmx9/GHSA-pw3g-hp64-xmx9.json b/advisories/unreviewed/2025/04/GHSA-pw3g-hp64-xmx9/GHSA-pw3g-hp64-xmx9.json index 6c779c491b4..b94f6042584 100644 --- a/advisories/unreviewed/2025/04/GHSA-pw3g-hp64-xmx9/GHSA-pw3g-hp64-xmx9.json +++ b/advisories/unreviewed/2025/04/GHSA-pw3g-hp64-xmx9/GHSA-pw3g-hp64-xmx9.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/04/GHSA-px97-mh8q-mm22/GHSA-px97-mh8q-mm22.json b/advisories/unreviewed/2025/04/GHSA-px97-mh8q-mm22/GHSA-px97-mh8q-mm22.json new file mode 100644 index 00000000000..f8b4446c5e4 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-px97-mh8q-mm22/GHSA-px97-mh8q-mm22.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-px97-mh8q-mm22", + "modified": "2025-04-07T15:31:13Z", + "published": "2025-04-07T15:31:13Z", + "aliases": [ + "CVE-2024-58133" + ], + "details": "In chainmaker-go (aka ChainMaker) before 2.4.0, when making frequent updates to a node's configuration file and restarting this node, concurrent writes by logger.go to a map are mishandled. Creating other logs simultaneously can lead to a read-write conflict and panic.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58133" + }, + { + "type": "WEB", + "url": "https://git.chainmaker.org.cn/chainmaker/issue/-/issues/1228" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-821" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-06T03:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-q4cw-226g-6pc5/GHSA-q4cw-226g-6pc5.json b/advisories/unreviewed/2025/04/GHSA-q4cw-226g-6pc5/GHSA-q4cw-226g-6pc5.json new file mode 100644 index 00000000000..a2547536cef --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-q4cw-226g-6pc5/GHSA-q4cw-226g-6pc5.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q4cw-226g-6pc5", + "modified": "2025-04-07T15:31:15Z", + "published": "2025-04-07T15:31:15Z", + "aliases": [ + "CVE-2025-3331" + ], + "details": "A vulnerability, which was classified as critical, has been found in codeprojects Online Restaurant Management System 1.0. This issue affects some unknown processing of the file /payment_save.php. The manipulation of the argument mode leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3331" + }, + { + "type": "WEB", + "url": "https://github.com/p1026/CVE/issues/45" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303545" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303545" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.551905" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T03:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-q7wx-4c6m-pm7w/GHSA-q7wx-4c6m-pm7w.json b/advisories/unreviewed/2025/04/GHSA-q7wx-4c6m-pm7w/GHSA-q7wx-4c6m-pm7w.json index a6b448086e2..a78454719c4 100644 --- a/advisories/unreviewed/2025/04/GHSA-q7wx-4c6m-pm7w/GHSA-q7wx-4c6m-pm7w.json +++ b/advisories/unreviewed/2025/04/GHSA-q7wx-4c6m-pm7w/GHSA-q7wx-4c6m-pm7w.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-q7wx-4c6m-pm7w", - "modified": "2025-04-04T15:31:17Z", + "modified": "2025-04-07T15:31:01Z", "published": "2025-04-04T15:31:17Z", "aliases": [ "CVE-2025-28146" ], "details": "Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotaUpgradeQuectel", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-04T14:15:21Z" diff --git a/advisories/unreviewed/2025/04/GHSA-qw6j-957m-52hg/GHSA-qw6j-957m-52hg.json b/advisories/unreviewed/2025/04/GHSA-qw6j-957m-52hg/GHSA-qw6j-957m-52hg.json new file mode 100644 index 00000000000..2abe91344b3 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-qw6j-957m-52hg/GHSA-qw6j-957m-52hg.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qw6j-957m-52hg", + "modified": "2025-04-07T15:31:21Z", + "published": "2025-04-07T15:31:21Z", + "aliases": [ + "CVE-2025-27686" + ], + "details": "Dell Unisphere for PowerMax, version(s) prior to 10.2.0.9 and PowerMax version(s) prior to PowerMax 9.2.4.15, contain an Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27686" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-ao/000302223/dsa-2025-111-dell-powermaxos-dell-powermax-eem-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-unisphere-360-dell-solutions-enabler-and-dell-solutions-enabler-virtual-appliance-security-update-for-multiple-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-90" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T14:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-r2cw-qpww-vp9w/GHSA-r2cw-qpww-vp9w.json b/advisories/unreviewed/2025/04/GHSA-r2cw-qpww-vp9w/GHSA-r2cw-qpww-vp9w.json new file mode 100644 index 00000000000..f726e5eda0d --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-r2cw-qpww-vp9w/GHSA-r2cw-qpww-vp9w.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r2cw-qpww-vp9w", + "modified": "2025-04-07T15:31:22Z", + "published": "2025-04-07T15:31:21Z", + "aliases": [ + "CVE-2025-3371" + ], + "details": "A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component DELETE Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3371" + }, + { + "type": "WEB", + "url": "https://fitoxs.com/exploit/exploit1.txt" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303617" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303617" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.552270" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T15:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-r4rq-7765-p57x/GHSA-r4rq-7765-p57x.json b/advisories/unreviewed/2025/04/GHSA-r4rq-7765-p57x/GHSA-r4rq-7765-p57x.json new file mode 100644 index 00000000000..655a67edabf --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-r4rq-7765-p57x/GHSA-r4rq-7765-p57x.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r4rq-7765-p57x", + "modified": "2025-04-07T15:31:11Z", + "published": "2025-04-07T15:31:11Z", + "aliases": [ + "CVE-2025-32365" + ], + "details": "Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32365" + }, + { + "type": "WEB", + "url": "https://gitlab.freedesktop.org/poppler/poppler/-/issues/1577" + }, + { + "type": "WEB", + "url": "https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1792" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T22:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-v3wx-2c9x-448x/GHSA-v3wx-2c9x-448x.json b/advisories/unreviewed/2025/04/GHSA-v3wx-2c9x-448x/GHSA-v3wx-2c9x-448x.json new file mode 100644 index 00000000000..a6cb406c7f9 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-v3wx-2c9x-448x/GHSA-v3wx-2c9x-448x.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v3wx-2c9x-448x", + "modified": "2025-04-07T15:31:21Z", + "published": "2025-04-07T15:31:21Z", + "aliases": [ + "CVE-2025-3353" + ], + "details": "A vulnerability was found in PHPGurukul Men Salon Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/add-services.php. The manipulation of the argument cost leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3353" + }, + { + "type": "WEB", + "url": "https://github.com/LaneyYu/cve/issues/3" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303567" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303567" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.552239" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T13:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-v9gv-mwp4-wx7g/GHSA-v9gv-mwp4-wx7g.json b/advisories/unreviewed/2025/04/GHSA-v9gv-mwp4-wx7g/GHSA-v9gv-mwp4-wx7g.json new file mode 100644 index 00000000000..093c4e93c93 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-v9gv-mwp4-wx7g/GHSA-v9gv-mwp4-wx7g.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v9gv-mwp4-wx7g", + "modified": "2025-04-07T15:31:21Z", + "published": "2025-04-07T15:31:21Z", + "aliases": [ + "CVE-2025-30195" + ], + "details": "An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service.\n\nThe remedy is: upgrade to the patched 5.2.1 version.\n\nWe would like to thank Volodymyr Ilyin for bringing this issue to our attention.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30195" + }, + { + "type": "WEB", + "url": "https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-01.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-476" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T14:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-vfcc-48gf-g8mq/GHSA-vfcc-48gf-g8mq.json b/advisories/unreviewed/2025/04/GHSA-vfcc-48gf-g8mq/GHSA-vfcc-48gf-g8mq.json new file mode 100644 index 00000000000..f2ce42e37e0 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-vfcc-48gf-g8mq/GHSA-vfcc-48gf-g8mq.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vfcc-48gf-g8mq", + "modified": "2025-04-07T15:31:21Z", + "published": "2025-04-07T15:31:21Z", + "aliases": [ + "CVE-2025-3352" + ], + "details": "A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/edit-scdetails.php. The manipulation of the argument contnum leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3352" + }, + { + "type": "WEB", + "url": "https://github.com/n0name-yang/myCVE/issues/3" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303566" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303566" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.552171" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T13:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-w447-6x96-2x3p/GHSA-w447-6x96-2x3p.json b/advisories/unreviewed/2025/04/GHSA-w447-6x96-2x3p/GHSA-w447-6x96-2x3p.json index 251b94cf3a2..2765d506cbd 100644 --- a/advisories/unreviewed/2025/04/GHSA-w447-6x96-2x3p/GHSA-w447-6x96-2x3p.json +++ b/advisories/unreviewed/2025/04/GHSA-w447-6x96-2x3p/GHSA-w447-6x96-2x3p.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-w447-6x96-2x3p", - "modified": "2025-04-06T09:30:24Z", + "modified": "2025-04-07T15:31:14Z", "published": "2025-04-06T09:30:24Z", "aliases": [ "CVE-2025-32369" @@ -22,6 +22,10 @@ { "type": "WEB", "url": "https://devnet.kentico.com/download/hotfixes" + }, + { + "type": "WEB", + "url": "https://labs.watchtowr.com/xss-to-rce-by-abusing-custom-file-handlers-kentico-xperience-cms-cve-2025-2748" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/04/GHSA-w888-5xmr-28f6/GHSA-w888-5xmr-28f6.json b/advisories/unreviewed/2025/04/GHSA-w888-5xmr-28f6/GHSA-w888-5xmr-28f6.json new file mode 100644 index 00000000000..33e59d938ba --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-w888-5xmr-28f6/GHSA-w888-5xmr-28f6.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w888-5xmr-28f6", + "modified": "2025-04-07T15:31:14Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-3309" + ], + "details": "A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/campsdetails.php. The manipulation of the argument hospital leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3309" + }, + { + "type": "WEB", + "url": "https://github.com/p1026/CVE/issues/26" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303506" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303506" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.550194" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-06T06:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-wr7w-v9gf-rw8c/GHSA-wr7w-v9gf-rw8c.json b/advisories/unreviewed/2025/04/GHSA-wr7w-v9gf-rw8c/GHSA-wr7w-v9gf-rw8c.json new file mode 100644 index 00000000000..01751468b80 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-wr7w-v9gf-rw8c/GHSA-wr7w-v9gf-rw8c.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wr7w-v9gf-rw8c", + "modified": "2025-04-07T15:31:14Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-3310" + ], + "details": "A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the file /admin/delete.php. The manipulation of the argument Search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3310" + }, + { + "type": "WEB", + "url": "https://github.com/p1026/CVE/issues/27" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303507" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303507" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.550195" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-06T06:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-x9f6-hx4w-vq6q/GHSA-x9f6-hx4w-vq6q.json b/advisories/unreviewed/2025/04/GHSA-x9f6-hx4w-vq6q/GHSA-x9f6-hx4w-vq6q.json index 0548ed183e9..2857e6832fc 100644 --- a/advisories/unreviewed/2025/04/GHSA-x9f6-hx4w-vq6q/GHSA-x9f6-hx4w-vq6q.json +++ b/advisories/unreviewed/2025/04/GHSA-x9f6-hx4w-vq6q/GHSA-x9f6-hx4w-vq6q.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-x9f6-hx4w-vq6q", - "modified": "2025-04-03T21:32:59Z", + "modified": "2025-04-07T15:30:54Z", "published": "2025-04-03T21:32:59Z", "aliases": [ "CVE-2025-29570" ], "details": "An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via the function tftp_image_check of a binary named rc.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-276" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-03T20:15:24Z" diff --git a/advisories/unreviewed/2025/04/GHSA-xc47-677g-jg4q/GHSA-xc47-677g-jg4q.json b/advisories/unreviewed/2025/04/GHSA-xc47-677g-jg4q/GHSA-xc47-677g-jg4q.json index a9563d63516..5741a72386a 100644 --- a/advisories/unreviewed/2025/04/GHSA-xc47-677g-jg4q/GHSA-xc47-677g-jg4q.json +++ b/advisories/unreviewed/2025/04/GHSA-xc47-677g-jg4q/GHSA-xc47-677g-jg4q.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-xc47-677g-jg4q", - "modified": "2025-04-07T06:30:27Z", + "modified": "2025-04-07T15:31:16Z", "published": "2025-04-07T06:30:27Z", "aliases": [ "CVE-2025-20661" ], "details": "In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: DTV04436357; Issue ID: MSV-3185.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-125" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-07T04:15:20Z" diff --git a/advisories/unreviewed/2025/04/GHSA-xc95-rpw4-jf66/GHSA-xc95-rpw4-jf66.json b/advisories/unreviewed/2025/04/GHSA-xc95-rpw4-jf66/GHSA-xc95-rpw4-jf66.json new file mode 100644 index 00000000000..0987dbda54b --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-xc95-rpw4-jf66/GHSA-xc95-rpw4-jf66.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xc95-rpw4-jf66", + "modified": "2025-04-07T15:31:14Z", + "published": "2025-04-07T15:31:14Z", + "aliases": [ + "CVE-2025-1264" + ], + "details": "The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to SQL Injection via the 'orderBy' parameter in all versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1264" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker-seo/trunk/app/Api/Api.php#L42" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker-seo/trunk/app/Api/LinkStatusTable.php#L31" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker-seo/trunk/app/Core/Database.php#L1357" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker-seo/trunk/app/Core/Database.php#L552" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3263416%40broken-link-checker-seo&new=3263416%40broken-link-checker-seo&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/broken-link-checker-seo" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce2d582e-4f50-4b55-9f3b-3c46d96c0927?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-06T05:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-xp37-x766-f7v4/GHSA-xp37-x766-f7v4.json b/advisories/unreviewed/2025/04/GHSA-xp37-x766-f7v4/GHSA-xp37-x766-f7v4.json new file mode 100644 index 00000000000..aef3da6a90a --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-xp37-x766-f7v4/GHSA-xp37-x766-f7v4.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xp37-x766-f7v4", + "modified": "2025-04-07T15:31:10Z", + "published": "2025-04-07T15:31:10Z", + "aliases": [ + "CVE-2025-3297" + ], + "details": "A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes/Master.php?f=save_product. The manipulation of the argument brand leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3297" + }, + { + "type": "WEB", + "url": "https://github.com/foreverfeifei/cve/blob/main/xss.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303492" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303492" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.549982" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T09:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-xqjh-59ww-r864/GHSA-xqjh-59ww-r864.json b/advisories/unreviewed/2025/04/GHSA-xqjh-59ww-r864/GHSA-xqjh-59ww-r864.json new file mode 100644 index 00000000000..da841c3f70d --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-xqjh-59ww-r864/GHSA-xqjh-59ww-r864.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xqjh-59ww-r864", + "modified": "2025-04-07T15:31:22Z", + "published": "2025-04-07T15:31:21Z", + "aliases": [ + "CVE-2025-3372" + ], + "details": "A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component MKDIR Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3372" + }, + { + "type": "WEB", + "url": "https://fitoxs.com/exploit/01-exploit.txt" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303618" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303618" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.552273" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-07T15:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-xrm4-vc7m-v28j/GHSA-xrm4-vc7m-v28j.json b/advisories/unreviewed/2025/04/GHSA-xrm4-vc7m-v28j/GHSA-xrm4-vc7m-v28j.json new file mode 100644 index 00000000000..84963b2fab5 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-xrm4-vc7m-v28j/GHSA-xrm4-vc7m-v28j.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xrm4-vc7m-v28j", + "modified": "2025-04-07T15:31:11Z", + "published": "2025-04-07T15:31:11Z", + "aliases": [ + "CVE-2025-3304" + ], + "details": "A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /dental_not.php. The manipulation of the argument itr_no leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3304" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/hyx123123/cve/blob/main/cve2.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.303501" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.303501" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.549645" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-05T22:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-xrqc-54h4-vmvv/GHSA-xrqc-54h4-vmvv.json b/advisories/unreviewed/2025/04/GHSA-xrqc-54h4-vmvv/GHSA-xrqc-54h4-vmvv.json index db829822999..9002c511ff9 100644 --- a/advisories/unreviewed/2025/04/GHSA-xrqc-54h4-vmvv/GHSA-xrqc-54h4-vmvv.json +++ b/advisories/unreviewed/2025/04/GHSA-xrqc-54h4-vmvv/GHSA-xrqc-54h4-vmvv.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-xrqc-54h4-vmvv", - "modified": "2025-04-07T06:30:27Z", + "modified": "2025-04-07T15:31:15Z", "published": "2025-04-07T06:30:27Z", "aliases": [ "CVE-2025-20654" ], "details": "In wlan service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00406897; Issue ID: MSV-2875.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-787" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-04-07T04:15:19Z"