Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-04-30 18:33:14 +00:00
parent 9ae3225938
commit b1fd56beb6
51 changed files with 703 additions and 47 deletions
@@ -30,6 +30,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-178",
      "CWE-863"
    ],
    "severity": "MODERATE",
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-vgg5-g88f-mq8p",
-  "modified": "2022-05-24T17:45:01Z",
+  "modified": "2025-04-30T18:31:37Z",
  "published": "2022-05-24T17:45:01Z",
  "aliases": [
    "CVE-2021-25921"
  ],
  "details": "In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` section. An attacker could lure an admin to enter a malicious payload and by that initiate the exploit.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7jfg-qpxp-6grc",
-  "modified": "2022-11-18T06:30:35Z",
+  "modified": "2025-04-30T18:31:40Z",
  "published": "2022-11-16T19:00:31Z",
  "aliases": [
    "CVE-2022-43264"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7jhg-5532-mghv",
-  "modified": "2022-11-17T06:30:19Z",
+  "modified": "2025-04-30T18:31:40Z",
  "published": "2022-11-16T12:00:20Z",
  "aliases": [
    "CVE-2022-30769"
@@ -23,6 +23,10 @@
      "type": "WEB",
      "url": "https://github.com/ZoneMinder/zoneminder/releases"
    },
+    {
+      "type": "WEB",
+      "url": "https://medium.com/%40dk50u1/session-fixation-in-zoneminder-up-to-v1-36-12-3c850b1fbbf3"
+    },
    {
      "type": "WEB",
      "url": "https://medium.com/@dk50u1/session-fixation-in-zoneminder-up-to-v1-36-12-3c850b1fbbf3"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-f6j2-5hv7-j68q",
-  "modified": "2022-11-21T18:30:36Z",
+  "modified": "2025-04-30T18:31:42Z",
  "published": "2022-11-17T03:30:49Z",
  "aliases": [
    "CVE-2022-42960"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fw87-542j-77hx",
-  "modified": "2022-11-17T03:30:52Z",
+  "modified": "2025-04-30T18:31:40Z",
  "published": "2022-11-16T19:00:31Z",
  "aliases": [
    "CVE-2022-43263"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-gx89-fjwq-4vh9",
-  "modified": "2022-11-17T03:30:51Z",
+  "modified": "2025-04-30T18:31:38Z",
  "published": "2022-11-14T19:00:19Z",
  "aliases": [
    "CVE-2022-43342"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mjxc-g8h2-2g9g",
-  "modified": "2022-11-18T06:30:35Z",
+  "modified": "2025-04-30T18:31:40Z",
  "published": "2022-11-16T12:00:20Z",
  "aliases": [
    "CVE-2022-30768"
@@ -23,6 +23,10 @@
      "type": "WEB",
      "url": "https://github.com/ZoneMinder/zoneminder/releases"
    },
+    {
+      "type": "WEB",
+      "url": "https://medium.com/%40dk50u1/stored-xss-in-zoneminder-up-to-v1-36-12-f26b4bb68c31"
+    },
    {
      "type": "WEB",
      "url": "https://medium.com/@dk50u1/stored-xss-in-zoneminder-up-to-v1-36-12-f26b4bb68c31"
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-693"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-400"
+    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-295"
+    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-312"
+      "CWE-312",
+      "CWE-89"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -37,7 +37,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-667"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-352"
+    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2ffg-57j4-xqr7",
-  "modified": "2025-04-30T15:30:49Z",
+  "modified": "2025-04-30T18:31:54Z",
  "published": "2025-04-30T15:30:49Z",
  "aliases": [
    "CVE-2025-45009"
  ],
  "details": "A HTML Injection vulnerability was discovered in the normal-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the searchdata parameter.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-77"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-30T14:15:28Z"
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "LOW",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2wq7-hx2p-5748",
+  "modified": "2025-04-30T18:31:55Z",
+  "published": "2025-04-30T18:31:55Z",
+  "aliases": [
+    "CVE-2025-30389"
+  ],
+  "details": "Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30389"
+    },
+    {
+      "type": "WEB",
+      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30389"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-285"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-30T18:15:46Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-37cp-q8j3-ccqw",
+  "modified": "2025-04-30T18:31:55Z",
+  "published": "2025-04-30T18:31:55Z",
+  "aliases": [
+    "CVE-2025-30391"
+  ],
+  "details": "Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30391"
+    },
+    {
+      "type": "WEB",
+      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30391"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-30T18:15:46Z"
+  }
+}
@@ -46,7 +46,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3hgc-5x5v-4fp3",
-  "modified": "2025-04-22T12:31:23Z",
+  "modified": "2025-04-30T18:31:54Z",
  "published": "2025-04-22T12:31:23Z",
  "aliases": [
    "CVE-2025-46235"
--- a/Show More
+++ b/Show More