netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-7cx3-6m66-7c5m
GHSA-22v8-p7h2-rj7p
GHSA-7r2m-8qrj-39h4
GHSA-frq9-3hp2-xvxg
GHSA-j7fr-xvx6-3p7v
GHSA-jcgm-66fg-63fv
This commit is contained in:
advisory-database[bot]
2025-05-29 06:33:20 +00:00
parent 4444aad67a
commit b3a5883ccf
6 changed files with 186 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/05/GHSA-7cx3-6m66-7c5m/GHSA-7cx3-6m66-7c5m.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7cx3-6m66-7c5m",
"modified": "2025-05-23T17:00:56Z",
"modified": "2025-05-29T06:31:17Z",
"published": "2025-05-16T14:12:40Z",
"aliases": [
"CVE-2025-47287"
@@ -51,6 +51,10 @@
{
"type": "PACKAGE",
"url": "https://github.com/tornadoweb/tornado"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00038.html"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-22v8-p7h2-rj7p/GHSA-22v8-p7h2-rj7p.json
+48
View File
@@ -0,0 +1,48 @@
{
"schema_version": "1.4.0",
"id": "GHSA-22v8-p7h2-rj7p",
"modified": "2025-05-29T06:31:17Z",
"published": "2025-05-29T06:31:17Z",
"aliases": [
"CVE-2025-5273"
],
"details": "All versions of the package mcp-markdownify-server are vulnerable to Files or Directories Accessible to External Parties via the get-markdown-file tool. An attacker can craft a prompt that, once accessed by the MCP host, will allow it to read arbitrary files from the host running the server.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5273"
},
{
"type": "WEB",
"url": "https://github.com/zcaceres/markdownify-mcp/commit/3a6b202d088ef7acb8be84bc09515f41a2b1a9df"
},
{
"type": "WEB",
"url": "https://github.com/zcaceres/markdownify-mcp/blob/3667bd4765c0e49684ce22df268d02dd478a7f3b/src/Markdownify.ts%23L94"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-MCPMARKDOWNIFYSERVER-10249193"
}
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-29T05:15:21Z"
}
}
advisories/unreviewed/2025/05/GHSA-7r2m-8qrj-39h4/GHSA-7r2m-8qrj-39h4.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7r2m-8qrj-39h4",
"modified": "2025-05-29T06:31:17Z",
"published": "2025-05-29T06:31:17Z",
"aliases": [
"CVE-2025-3755"
],
"details": "Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules allows a remote unauthenticated attacker to read information in the product, to cause a Denial-of-Service (DoS) condition in MELSOFT connection, or to stop the operation of the CPU module (causing a DoS condtion on the CPU module), by sending specially crafted packets. The product is needed to reset for recovery.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3755"
},
{
"type": "WEB",
"url": "https://jvn.jp/vu/JVNVU94070048"
},
{
"type": "WEB",
"url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-003_en.pdf"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1285"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-29T05:15:20Z"
}
}
advisories/unreviewed/2025/05/GHSA-frq9-3hp2-xvxg/GHSA-frq9-3hp2-xvxg.json
+48
View File
@@ -0,0 +1,48 @@
{
"schema_version": "1.4.0",
"id": "GHSA-frq9-3hp2-xvxg",
"modified": "2025-05-29T06:31:17Z",
"published": "2025-05-29T06:31:17Z",
"aliases": [
"CVE-2025-5276"
],
"details": "All versions of the package mcp-markdownify-server are vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() function. An attacker can craft a prompt that, once accessed by the MCP host, can invoke the webpage-to-markdown, bing-search-to-markdown, and youtube-to-markdown tools to issue requests and read the responses to attacker-controlled URLs, potentially leaking sensitive information.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5276"
},
{
"type": "WEB",
"url": "https://github.com/zcaceres/markdownify-mcp/commit/0284aa8f34d32c65e20d8cda2d429b7943c9af03"
},
{
"type": "WEB",
"url": "https://github.com/zcaceres/markdownify-mcp/blob/224cf89f0d58616d2a5522f60f184e8391d1c9e3/src/server.ts%23L20C17-L20C29"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-MCPMARKDOWNIFYSERVER-10249387"
}
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-29T05:15:21Z"
}
}
advisories/unreviewed/2025/05/GHSA-j7fr-xvx6-3p7v/GHSA-j7fr-xvx6-3p7v.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j7fr-xvx6-3p7v",
"modified": "2025-05-16T00:31:07Z",
"modified": "2025-05-29T06:31:17Z",
"published": "2025-05-16T00:31:07Z",
"aliases": [
"CVE-2025-0921"
@@ -23,6 +23,10 @@
"type": "WEB",
"url": "https://jvn.jp/vu/JVNVU93838985"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04"
},
{
"type": "WEB",
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2025-002_en.pdf"
advisories/unreviewed/2025/05/GHSA-jcgm-66fg-63fv/GHSA-jcgm-66fg-63fv.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jcgm-66fg-63fv",
"modified": "2025-05-29T06:31:17Z",
"published": "2025-05-29T06:31:17Z",
"aliases": [
"CVE-2025-4583"
],
"details": "The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-plugin` attribute in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4583"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.9.0/js/sb-instagram-admin-6.js#L428"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/23e47daa-79e7-4ed3-a88a-0f090e9aa277?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-29T05:15:21Z"
}
}