netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-8464-8v52-xm79
GHSA-f6c3-7j6r-gqx3
GHSA-j4jc-69x3-7rr6
GHSA-pwgw-g9f5-ghw2
GHSA-q7wx-v3rg-fjvx
GHSA-xwpp-qxq5-q73h
This commit is contained in:
advisory-database[bot]
2025-01-06 00:32:05 +00:00
parent 84da9685a3
commit bdaf449ee1
6 changed files with 316 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/01/GHSA-8464-8v52-xm79/GHSA-8464-8v52-xm79.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8464-8v52-xm79",
"modified": "2025-01-06T00:30:41Z",
"published": "2025-01-06T00:30:41Z",
"aliases": [
"CVE-2024-13144"
],
"details": "A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/site/blog/my/core/controller/admin/BlogController.java. The manipulation of the argument editormd-image-file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13144"
},
{
"type": "WEB",
"url": "https://github.com/ZHENFENG13/My-Blog/issues/140"
},
{
"type": "WEB",
"url": "https://github.com/ZHENFENG13/My-Blog/issues/140#issue-2759813820"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.290232"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.290232"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.469220"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-06T00:15:05Z"
}
}
advisories/unreviewed/2025/01/GHSA-f6c3-7j6r-gqx3/GHSA-f6c3-7j6r-gqx3.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f6c3-7j6r-gqx3",
"modified": "2025-01-06T00:30:41Z",
"published": "2025-01-06T00:30:41Z",
"aliases": [
"CVE-2025-0232"
],
"details": "A vulnerability was found in Codezips Blood Bank Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /successadmin.php. The manipulation of the argument psw leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0232"
},
{
"type": "WEB",
"url": "https://github.com/alc9700jmo/CVE/issues/7"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.290228"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.290228"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.474597"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-05T22:15:05Z"
}
}
advisories/unreviewed/2025/01/GHSA-j4jc-69x3-7rr6/GHSA-j4jc-69x3-7rr6.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j4jc-69x3-7rr6",
"modified": "2025-01-06T00:30:41Z",
"published": "2025-01-06T00:30:41Z",
"aliases": [
"CVE-2024-13143"
],
"details": "A vulnerability was found in ZeroWdd studentmanager 1.0. It has been rated as problematic. This issue affects the function submitAddPermission of the file src/main/java/com/zero/system/controller/PermissionController. java. The manipulation of the argument url leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13143"
},
{
"type": "WEB",
"url": "https://github.com/ZeroWdd/manager-system/issues/7"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.290231"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.290231"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.469217"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-06T00:15:05Z"
}
}
advisories/unreviewed/2025/01/GHSA-pwgw-g9f5-ghw2/GHSA-pwgw-g9f5-ghw2.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pwgw-g9f5-ghw2",
"modified": "2025-01-06T00:30:41Z",
"published": "2025-01-06T00:30:41Z",
"aliases": [
"CVE-2025-0233"
],
"details": "A vulnerability was found in Codezips Project Management System 1.0. It has been classified as critical. This affects an unknown part of the file /pages/forms/course.php. The manipulation of the argument course_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0233"
},
{
"type": "WEB",
"url": "https://github.com/1074923869/CVE/issues/1"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.290229"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.290229"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.474673"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-05T23:15:07Z"
}
}
advisories/unreviewed/2025/01/GHSA-q7wx-v3rg-fjvx/GHSA-q7wx-v3rg-fjvx.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q7wx-v3rg-fjvx",
"modified": "2025-01-06T00:30:41Z",
"published": "2025-01-06T00:30:41Z",
"aliases": [
"CVE-2024-13142"
],
"details": "A vulnerability was found in ZeroWdd studentmanager 1.0. It has been declared as problematic. This vulnerability affects the function submitAddRole of the file src/main/java/com/zero/system/controller/RoleController. java. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13142"
},
{
"type": "WEB",
"url": "https://github.com/ZeroWdd/manager-system/issues/6"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.290230"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.290230"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.469213"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-05T23:15:06Z"
}
}
advisories/unreviewed/2025/01/GHSA-xwpp-qxq5-q73h/GHSA-xwpp-qxq5-q73h.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xwpp-qxq5-q73h",
"modified": "2025-01-06T00:30:41Z",
"published": "2025-01-06T00:30:41Z",
"aliases": [
"CVE-2025-0231"
],
"details": "A vulnerability has been found in Codezips Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/admin/submit_payments.php. The manipulation of the argument m_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0231"
},
{
"type": "WEB",
"url": "https://github.com/gh464646/CVE/issues/1"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.290227"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.290227"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.474596"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-05T22:15:05Z"
}
}