netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3cxc-phxh-65vq
GHSA-3w5w-m35v-rfp7
GHSA-734j-rghv-fj5v
GHSA-7g9v-7vc7-pmrw
GHSA-c48q-x6xw-g5h8
GHSA-gr77-83rx-v97c
GHSA-m4w2-g4cp-m5hw
GHSA-rfcx-6p2f-m3vg
This commit is contained in:
advisory-database[bot]
2025-04-21 00:31:26 +00:00
parent 5af33b6581
commit a703fceba7
8 changed files with 332 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/04/GHSA-3cxc-phxh-65vq/GHSA-3cxc-phxh-65vq.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3cxc-phxh-65vq",
"modified": "2025-04-21T00:30:19Z",
"published": "2025-04-21T00:30:19Z",
"aliases": [
"CVE-2025-43964"
],
"details": "In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43964"
},
{
"type": "WEB",
"url": "https://github.com/LibRaw/LibRaw/commit/a50dc3f1127d2e37a9b39f57ad9bb2ebb60f18c0"
},
{
"type": "WEB",
"url": "https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4"
},
{
"type": "WEB",
"url": "https://www.libraw.org/news/libraw-0-21-4-release"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1284"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-21T00:15:33Z"
}
}
advisories/unreviewed/2025/04/GHSA-3w5w-m35v-rfp7/GHSA-3w5w-m35v-rfp7.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3w5w-m35v-rfp7",
"modified": "2025-04-21T00:30:20Z",
"published": "2025-04-21T00:30:19Z",
"aliases": [
"CVE-2025-43963"
],
"details": "In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43963"
},
{
"type": "WEB",
"url": "https://github.com/LibRaw/LibRaw/commit/be26e7639ecf8beb55f124ce780e99842de2e964"
},
{
"type": "WEB",
"url": "https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4"
},
{
"type": "WEB",
"url": "https://www.libraw.org/news/libraw-0-21-4-release"
}
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-21T00:15:33Z"
}
}
advisories/unreviewed/2025/04/GHSA-734j-rghv-fj5v/GHSA-734j-rghv-fj5v.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-734j-rghv-fj5v",
"modified": "2025-04-21T00:30:19Z",
"published": "2025-04-21T00:30:19Z",
"aliases": [
"CVE-2020-36844"
],
"details": "The KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS. The response has a SCRIPT element that sets window.location.href to a JavaScript URL.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36844"
},
{
"type": "WEB",
"url": "https://www.doyler.net/security-not-included/knowbe4-vulnerabilities"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-20T22:15:28Z"
}
}
advisories/unreviewed/2025/04/GHSA-7g9v-7vc7-pmrw/GHSA-7g9v-7vc7-pmrw.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7g9v-7vc7-pmrw",
"modified": "2025-04-21T00:30:20Z",
"published": "2025-04-21T00:30:19Z",
"aliases": [
"CVE-2025-43966"
],
"details": "libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43966"
},
{
"type": "WEB",
"url": "https://github.com/strukturag/libheif/commit/b38555387e4b5dcf036fe45b0c440aca19b7b69c"
},
{
"type": "WEB",
"url": "https://github.com/strukturag/libheif/compare/v1.19.5...v1.19.6"
}
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-21T00:15:33Z"
}
}
advisories/unreviewed/2025/04/GHSA-c48q-x6xw-g5h8/GHSA-c48q-x6xw-g5h8.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c48q-x6xw-g5h8",
"modified": "2025-04-21T00:30:20Z",
"published": "2025-04-21T00:30:20Z",
"aliases": [
"CVE-2025-43967"
],
"details": "libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can reference a nonexistent image item.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43967"
},
{
"type": "WEB",
"url": "https://github.com/strukturag/libheif/issues/1455"
},
{
"type": "WEB",
"url": "https://github.com/strukturag/libheif/commit/6e35af7b0ff9fb6cc952a1539590d160db32f671"
},
{
"type": "WEB",
"url": "https://github.com/strukturag/libheif/compare/v1.19.5...v1.19.6"
}
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-21T00:15:33Z"
}
}
advisories/unreviewed/2025/04/GHSA-gr77-83rx-v97c/GHSA-gr77-83rx-v97c.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gr77-83rx-v97c",
"modified": "2025-04-21T00:30:19Z",
"published": "2025-04-21T00:30:19Z",
"aliases": [
"CVE-2025-43962"
],
"details": "In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43962"
},
{
"type": "WEB",
"url": "https://github.com/LibRaw/LibRaw/commit/66fe663e02a4dd610b4e832f5d9af326709336c2"
},
{
"type": "WEB",
"url": "https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4"
},
{
"type": "WEB",
"url": "https://www.libraw.org/news/libraw-0-21-4-release"
}
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-21T00:15:33Z"
}
}
advisories/unreviewed/2025/04/GHSA-m4w2-g4cp-m5hw/GHSA-m4w2-g4cp-m5hw.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m4w2-g4cp-m5hw",
"modified": "2025-04-21T00:30:19Z",
"published": "2025-04-21T00:30:19Z",
"aliases": [
"CVE-2025-43961"
],
"details": "In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43961"
},
{
"type": "WEB",
"url": "https://github.com/LibRaw/LibRaw/commit/66fe663e02a4dd610b4e832f5d9af326709336c2"
},
{
"type": "WEB",
"url": "https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4"
},
{
"type": "WEB",
"url": "https://www.libraw.org/news/libraw-0-21-4-release"
}
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-21T00:15:32Z"
}
}
advisories/unreviewed/2025/04/GHSA-rfcx-6p2f-m3vg/GHSA-rfcx-6p2f-m3vg.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rfcx-6p2f-m3vg",
"modified": "2025-04-21T00:30:19Z",
"published": "2025-04-21T00:30:19Z",
"aliases": [
"CVE-2020-36845"
],
"details": "The KnowBe4 Security Awareness Training application before 2020-01-10 contains a redirect function that does not validate the destination URL before redirecting. The response has a SCRIPT element that sets window.location.href to an arbitrary https URL.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36845"
},
{
"type": "WEB",
"url": "https://www.doyler.net/security-not-included/knowbe4-vulnerabilities"
}
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-20T22:15:29Z"
}
}